1caf3cf07b3692a16cf5adc8c1f6706add3aa1300f2b45154731e47a585bdf8e

Analysis

max time kernel
119s
max time network
131s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 08:38 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

սɱ.exe
Size

1.5MB
MD5

12835ec50b38704a3c9be650ad3e214c
SHA1

6d8824e49cfd36839efc832a16923605e36385fa
SHA256

ac137e6d5d2dbc828233e2c785a22d4311c4ec9e72a03ec5a74bbfe48b1f0e1f
SHA512

c784bed7692860a17e71f8118b6d31647ddbc1e0e6932a604d98ee20a8d87526714bfa3d597d4df11edc5108ebaab254559f4df5da608f6b6d491bfda6442434
SSDEEP

24576:35pAV6RUDy7ITASD2v4/oUyTXAFuf2FfWl8KuqGavkg3NyNIbbbIoIBAUZLYl2r:PAV6+Dy7IYvfTTXG2+s8KuqGaX0ToIBP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1624	FP_AX_CAB_INSTALLER64.exe

Loads dropped DLL 1 IoCs

pid	Process
2852	սɱ.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	սɱ.exe
File opened for modification	C:\Windows\Downloaded Program Files\SET76D5.tmp	սɱ.exe
File created	C:\Windows\Downloaded Program Files\SET76D5.tmp	սɱ.exe
File opened for modification	C:\Windows\Downloaded Program Files\swflash64.inf	սɱ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FP_AX_CAB_INSTALLER64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	սɱ.exe

Modifies Internet Explorer settings 1 TTPs 37 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 005a8f3e8b1adb01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006be39fef5bd7014db0cb58fed12b7d13000000000200000000001066000000010000200000003de58b6518321873afb7006414f3690a3e9fb32c765c85783942663d8a65f2a4000000000e80000000020000200000004b08221164fb57987bb1b42b264778cbafa2a7187998407d4c0274d1819fa084900000005d3da1d759cedaf7d599f2a4f0c3d0475120e32c69a5922aab2a8c58f0ee146ce3ae87d95550aa372fad4c9e0092160fe2bed9f868595a894ab528247ac91ae327b7da199071627f106f7954593bbae138549379e691f4215fbac6f16215deccec55c713195b86b61caf02033823879c237fa837ca1c6d1d3bc762a7697274a0d772901d728fccb4ffdd60636215013240000000749629860247812bb0b3c0132fe212588f0dbe7965d9271031973b4ffb6ee98877559c9c403a5c940485ac98d316060435ab54cbf4b83e26e10dbdacc6f02d32	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	սɱ.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "3"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434668163"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{68B79631-867E-11EF-BDF4-FEF21B3B37D6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006be39fef5bd7014db0cb58fed12b7d1300000000020000000000106600000001000020000000f60f64077991b4db8d2e1eccb806d4b37d7d646b67d015cf075968ef9d517be2000000000e8000000002000020000000267f1b3287486674a0ac9b358d838accbad1dcb7c1be4d6932b44668abc38e03200000007bacd0bc4a61ac11056005c12e32008fad6229cc662ed59b98d4711870fc9a3040000000d41cb2633514b8050bc7437bd7357c0ae7dad9654d939049cc10408b10ea71d326920e8a70b808c7e81ee4c4ed929d39d57d872e1426a18977fd410cc7bfbc76	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main	սɱ.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	սɱ.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	սɱ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	սɱ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	սɱ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	սɱ.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	սɱ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	սɱ.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	սɱ.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1624	FP_AX_CAB_INSTALLER64.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeRestorePrivilege	2852	սɱ.exe
Token: SeRestorePrivilege	2852	սɱ.exe
Token: SeRestorePrivilege	2852	սɱ.exe
Token: SeRestorePrivilege	2852	սɱ.exe
Token: SeRestorePrivilege	2852	սɱ.exe
Token: SeRestorePrivilege	2852	սɱ.exe
Token: SeRestorePrivilege	2852	սɱ.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
316	iexplore.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2852	սɱ.exe
2852	սɱ.exe
2852	սɱ.exe
2852	սɱ.exe
316	iexplore.exe
316	iexplore.exe
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE
2496	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 2852 wrote to memory of 1624	2852	սɱ.exe	31
PID 1624 wrote to memory of 316	1624	FP_AX_CAB_INSTALLER64.exe	32
PID 1624 wrote to memory of 316	1624	FP_AX_CAB_INSTALLER64.exe	32
PID 1624 wrote to memory of 316	1624	FP_AX_CAB_INSTALLER64.exe	32
PID 1624 wrote to memory of 316	1624	FP_AX_CAB_INSTALLER64.exe	32
PID 316 wrote to memory of 2496	316	iexplore.exe	33
PID 316 wrote to memory of 2496	316	iexplore.exe	33
PID 316 wrote to memory of 2496	316	iexplore.exe	33
PID 316 wrote to memory of 2496	316	iexplore.exe	33

C:\Users\Admin\AppData\Local\Temp\սɱ.exe
"C:\Users\Admin\AppData\Local\Temp\սɱ.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
  C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://get3.adobe.com/flashplayer/update/activex
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:316
  - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:316 CREDAT:275457 /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      PID:2496

Network

DNS

www.4399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

www.4399.com

IN A

Response

www.4399.com

IN CNAME

www.4399.com.lxdns.com

www.4399.com.lxdns.com

IN A

174.35.118.63

www.4399.com.lxdns.com

IN A

163.171.130.132

www.4399.com.lxdns.com

IN A

174.35.118.62

www.4399.com.lxdns.com

IN A

163.171.129.134
GET

http://www.4399.com/flash/123456_1.htm

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /flash/123456_1.htm HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 09 Oct 2024 21:07:08 GMT
Server: nginx
Last-Modified: Fri, 20 Sep 2024 09:23:59 GMT
ETag: W/"66ed3f2f-e24f"
Cache-Control: max-age=1800
Content-Encoding: gzip
Age: 65
X-Via: 1.1 PSelsmskMOW3oa101:11 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:7 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_PS-LHR-01q9k95_766-40456
X-Request-Id: 42c42f4bab5e548ff1efe7b236e33512
GET

http://www.4399.com/css/publicCssForPlay.css

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /css/publicCssForPlay.css HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:08 GMT
Server: nginx
Last-Modified: Wed, 24 May 2017 03:41:02 GMT
ETag: W/"592500ce-1c95"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:10 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:12 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_PS-LHR-01q9k95_766-40473
X-Request-Id: af114bc31608f633d95220fdb6f285a1
GET

http://www.4399.com/css/gameKeyForPlay.css

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /css/gameKeyForPlay.css HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:08 GMT
Server: nginx
Last-Modified: Thu, 27 Apr 2017 01:21:35 GMT
ETag: W/"5901479f-d1d"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:12 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:14 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_PS-LHR-01q9k95_766-40479
X-Request-Id: c47ed77399ce741ec6f51bf013078296
GET

http://www.4399.com/images/fl2016/logo.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/fl2016/logo.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: image/png
Content-Length: 3005
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:11 GMT
Server: nginx
Last-Modified: Tue, 19 Apr 2016 06:35:49 GMT
ETag: "5715d1c5-bbd"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:0 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:6 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:18 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_PS-LHR-01q9k95_766-40481
X-Request-Id: 25b2c959c881254f993c30b6f739a7e1
GET

http://www.4399.com/css/index3/color0.css

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /css/index3/color0.css HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: text/css
Content-Length: 9
Connection: keep-alive
Expires: Tue, 07 Jan 2025 19:07:15 GMT
Server: nginx
Last-Modified: Thu, 17 Jul 2014 06:33:50 GMT
ETag: "53c76e4e-9"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:7 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:8 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40497
X-Request-Id: 81be9df619dd8e55e646e74fea82692d
GET

http://www.4399.com/images/p2016/colour-1.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/colour-1.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 4158
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Tue, 28 Mar 2017 07:16:32 GMT
ETag: "58da0dd0-103e"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 12043483:5 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:1 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:4 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40502
X-Request-Id: b8bcbd35ddb2d48023a7ffdada9c9501
GET

http://www.4399.com/images/p2016/sg.gif

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/sg.gif HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/gif
Content-Length: 17733
Connection: keep-alive
Expires: Tue, 07 Jan 2025 19:42:49 GMT
Server: nginx
Last-Modified: Fri, 22 Oct 2021 07:42:27 GMT
ETag: "61726b63-4545"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHKG8ld122:4 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:14 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:21 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40508
X-Request-Id: 0b5333fd6e9ae487bab6db84dd0e815c
GET

http://www.4399.com/jss/jquery-1.6.1.min.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/jquery-1.6.1.min.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:45:42 GMT
Server: nginx
Last-Modified: Sun, 10 Nov 2013 09:24:37 GMT
ETag: W/"527f50d5-164ce"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:14 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:3 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40509
X-Request-Id: 2dff036fae53c68b830c4a876f3ef97f
GET

http://www.4399.com/images/p2016/f-scr2.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/f-scr2.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 5036
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:08:53 GMT
Server: nginx
Last-Modified: Fri, 24 Feb 2017 06:47:37 GMT
ETag: "58afd709-13ac"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:5 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:3 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40517
X-Request-Id: 31fc0dcb4e164662b878915292ca9f9b
GET

http://www.4399.com/images/fix2.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/fix2.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 5491
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:10 GMT
Server: nginx
Last-Modified: Mon, 24 Apr 2023 07:55:55 GMT
ETag: "6446360b-1573"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:10 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:17 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40518
X-Request-Id: 150291eb69926aa171e2d77803b06897
GET

http://www.4399.com/images/p2016/icon-keyboard.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/icon-keyboard.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 6013
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:11 GMT
Server: nginx
Last-Modified: Mon, 27 Mar 2017 08:16:13 GMT
ETag: "58d8ca4d-177d"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:5 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:2 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:7 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40524
X-Request-Id: 64ecb923fd13f42842fb1a783635449c
GET

http://www.4399.com/images/p2016/mask-p.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/mask-p.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 1211
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Tue, 13 Dec 2016 01:36:03 GMT
ETag: "584f5083-4bb"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:10 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:9 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40527
X-Request-Id: 178a3909badcc0067cea600c2a6b192b
GET

http://www.4399.com/jss/lazy_iframe_new.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/lazy_iframe_new.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 19:27:54 GMT
Server: nginx
Last-Modified: Tue, 19 Apr 2022 00:36:51 GMT
ETag: W/"625e0423-1aab"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:6 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:9 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40534
X-Request-Id: cbdf3c5745b10aa950eba4f946560fe1
GET

http://www.4399.com/jss/sosmart1_s.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/sosmart1_s.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:11 GMT
Server: nginx
Last-Modified: Tue, 30 Mar 2021 06:59:11 GMT
ETag: W/"6062cc3f-229e"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:4 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:20 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40539
X-Request-Id: 179f61f6d89f03e1fcc045460ad72778
GET

http://www.4399.com/images/abclo2.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/abclo2.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 1229
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:10 GMT
Server: nginx
Last-Modified: Mon, 16 Sep 2019 09:48:39 GMT
ETag: "5d7f5a77-4cd"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:9 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:1 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40543
X-Request-Id: 0b2f815182dc0944deea338ab38a1977
GET

http://www.4399.com/js/globalSearchWord.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /js/globalSearchWord.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Content-Length: 162
Connection: keep-alive
Expires: Wed, 09 Oct 2024 19:11:08 GMT
Server: nginx
Last-Modified: Thu, 16 Nov 2023 01:03:54 GMT
ETag: "65556a7a-a2"
Cache-Control: max-age=3600
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 12043483:6 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3cd100:4 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:20 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40548
X-Request-Id: c9a4e0dd08761ca2545576162ec56dd9
GET

http://www.4399.com/jss/newHeadjsForPlay_s.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/newHeadjsForPlay_s.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Wed, 04 Aug 2021 06:13:36 GMT
ETag: W/"610a3010-3a6a"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:0 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40555
X-Request-Id: 760025726bf853e7497db585916d48b8
GET

http://www.4399.com/jss/girlJsForPlay20220701.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/girlJsForPlay20220701.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:37:09 GMT
Server: nginx
Last-Modified: Fri, 01 Jul 2022 05:46:12 GMT
ETag: W/"62be8a24-da49"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:2 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:12 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40564
X-Request-Id: eb343005bd0f0f3c81239c4458b90525
GET

http://www.4399.com/jss/unilogin2.js?0102

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/unilogin2.js?0102 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Tue, 14 Dec 2021 07:28:19 GMT
ETag: W/"61b84793-b05"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:2 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:14 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40568
X-Request-Id: 1332633bf78385ada895c77b15f37e9e
GET

http://www.4399.com/jss/hasPlayedForPlay.js?111

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/hasPlayedForPlay.js?111 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:08 GMT
Server: nginx
Last-Modified: Wed, 03 Mar 2021 02:15:26 GMT
ETag: W/"603ef13e-2365"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:4 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:20 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_766-40571
X-Request-Id: 4c8f94c8430609de150f2e613ed26ac0
GET

http://www.4399.com/jss/flashopen1.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/flashopen1.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Tue, 23 Apr 2024 03:31:33 GMT
ETag: W/"66272b95-d55"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:13 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:9 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_766-40576
X-Request-Id: cee1094ec934292f4216ea9884cc481a
GET

http://www.4399.com/images/i2016/QR.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/i2016/QR.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: image/png
Content-Length: 7492
Connection: keep-alive
Expires: Tue, 07 Jan 2025 16:39:57 GMT
Server: nginx
Last-Modified: Mon, 13 Mar 2017 02:30:42 GMT
ETag: "58c60452-1d44"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:8 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_766-40580
X-Request-Id: 5c9946bdf0bfd6ca2a45733c03cb03b6
GET

http://www.4399.com/jss/allInOneAntiindulgencePC.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/allInOneAntiindulgencePC.js HTTP/1.1
Accept: */*
Referer: http://sbai.4399.com/4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: application/x-javascript
Content-Length: 848
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:08:41 GMT
Server: nginx
Last-Modified: Thu, 11 Nov 2021 06:13:40 GMT
ETag: "618cb494-350"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:11 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:13 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_766-40583
X-Request-Id: f381471e71b53b6891cadd5d9351bba4
GET

http://www.4399.com/antijs/Antiindulgence.js?20241092

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /antijs/Antiindulgence.js?20241092 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:08:14 GMT
Server: nginx
Last-Modified: Tue, 18 Jul 2023 07:39:31 GMT
ETag: W/"64b641b3-802b"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:3 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_766-40604
X-Request-Id: 161ba2f0b093a196835078014c105b1e
GET

http://www.4399.com/loadimg/noInstallFlashIE.html

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /loadimg/noInstallFlashIE.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:38:17 GMT
Server: nginx
Last-Modified: Sun, 29 Sep 2024 03:48:10 GMT
ETag: W/"66f8cdfa-ee0"
Cache-Control: max-age=7776000
Content-Encoding: gzip
X-Via: 1.1 PSelsmskMOW3vl102:3 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:0 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_766-40737
X-Request-Id: 139d5c3d6c581ad668a53f71c1a13b1d
GET

http://www.4399.com/httpsNot301/blockflashtip_2022/browserIcon-360-big.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/blockflashtip_2022/browserIcon-360-big.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: image/png
Content-Length: 2866
Connection: keep-alive
Expires: Tue, 07 Jan 2025 19:04:23 GMT
Server: nginx
Last-Modified: Mon, 07 Nov 2022 06:59:54 GMT
ETag: "6368acea-b32"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:0 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:8 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:20 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_766-40777
X-Request-Id: a3a4c15e79679d698aa4dec60ab726a8
GET

http://www.4399.com/jss/jquery-11.2.min.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/jquery-11.2.min.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Sat, 04 Jun 2016 07:01:39 GMT
ETag: W/"57527cd3-176bb"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:10 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:5 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_766-40908
X-Request-Id: ce882c32b0cf3a442af586d59ecbf07a
GET

http://www.4399.com/images/age/newBgAll.jpg

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/age/newBgAll.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: image/jpeg
Content-Length: 54161
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Mon, 20 Jun 2022 05:44:56 GMT
ETag: "62b00958-d391"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:3 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:8 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:21 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_766-40914
X-Request-Id: 3e50462efd759bd8bd3b6e2b646d557b
GET

http://www.4399.com/images/age/ageLimit-tip.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/age/ageLimit-tip.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: image/png
Content-Length: 5236
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Mon, 16 May 2022 01:51:50 GMT
ETag: "6281ae36-1474"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:3 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:13 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:21 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_766-40919
X-Request-Id: 6d3574b98406ea6a574f22e314012493
GET

http://www.4399.com/age/123456.js?_=1728506298872

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /age/123456.js?_=1728506298872 HTTP/1.1
x-requested-with: XMLHttpRequest
Accept-Language: en-us
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:20 GMT
Content-Type: application/x-javascript
Content-Length: 1229
Connection: keep-alive
Server: nginx
Last-Modified: Fri, 19 Aug 2022 02:31:18 GMT
ETag: "62fef5f6-4cd"
Expires: Tue, 07 Jan 2025 20:38:20 GMT
Cache-Control: max-age=7776000
Accept-Ranges: bytes
X-Via: 1.1 PSelsmskMOW3cd100:7 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:16 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_766-40921
X-Request-Id: 58a9a1e67feb3443b9662dc174d28bd1
GET

http://www.4399.com/images/age/16.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/age/16.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:20 GMT
Content-Type: image/png
Content-Length: 58674
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:43 GMT
Server: nginx
Last-Modified: Fri, 10 Jun 2022 09:09:48 GMT
ETag: "62a30a5c-e532"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 12043483:14 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:6 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bc_PS-LHR-01q9k95_766-40954
X-Request-Id: f821ade1b6c813bfa78d2ba358fa1244
GET

http://www.4399.com/images/Antiindulgence/ptlogin_mask.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/Antiindulgence/ptlogin_mask.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:39 GMT
Content-Type: image/png
Content-Length: 1074
Connection: keep-alive
Expires: Tue, 07 Jan 2025 18:30:05 GMT
Server: nginx
Last-Modified: Tue, 01 Sep 2020 06:58:09 GMT
ETag: "5f4df101-432"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:14 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9cf_PS-LHR-01q9k95_766-42462
X-Request-Id: 334df758ca24d973818223e391577853
GET

http://www.4399.com/css/commonCssForPlay20230424.css

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /css/commonCssForPlay20230424.css HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:08 GMT
Server: nginx
Last-Modified: Tue, 25 Apr 2023 09:18:11 GMT
ETag: W/"64479ad3-6148"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:14 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:5 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_PS-LHR-01q9k95_48135-53010
X-Request-Id: 02567d211cb08c0c377feb984e7e1056
GET

http://www.4399.com/js/serversbai.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /js/serversbai.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: application/x-javascript
Content-Length: 83
Connection: keep-alive
Expires: Wed, 09 Oct 2024 21:37:08 GMT
Server: nginx
Last-Modified: Mon, 11 Oct 2021 01:56:18 GMT
ETag: "616399c2-53"
Cache-Control: max-age=3600
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHKG8ef124:2 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3cd100:2 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:1 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_PS-LHR-01q9k95_48135-53014
X-Request-Id: c02ecc2dc394df2f002642f617f7870a
GET

http://www.4399.com/images/p2016/fix.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/fix.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 7844
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Fri, 24 Mar 2017 01:13:18 GMT
ETag: "58d472ae-1ea4"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:2 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:3 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:18 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53045
X-Request-Id: 0ebcc8f009dd0a003aec869b057553bc
GET

http://www.4399.com/loadimg/loading.htm

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /loadimg/loading.htm HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 09 Oct 2024 18:34:23 GMT
Server: nginx
Last-Modified: Wed, 09 Oct 2024 01:27:47 GMT
ETag: W/"6705dc13-b9e"
Cache-Control: max-age=1800
Content-Encoding: gzip
Age: 9231
X-Via: 1.1 PSelsmskMOW3vl102:6 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:11 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53049
X-Request-Id: 200b394310530590922ebbe39bf1e31f
GET

http://www.4399.com/images/p2016/fix2.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/fix2.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 5491
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:37:09 GMT
Server: nginx
Last-Modified: Tue, 01 Sep 2020 06:58:09 GMT
ETag: "5f4df101-1573"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:5 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:19 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53064
X-Request-Id: e98278e9aa37474d65a9ed1148bc8e9a
GET

http://www.4399.com/images/p2016/mask.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/mask.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 1070
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Tue, 13 Dec 2016 01:36:03 GMT
ETag: "584f5083-42e"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:0 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:8 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:1 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53069
X-Request-Id: 627eaa59153f770f0afcc1487b9be77c
GET

http://www.4399.com/images/p2016/more_ico.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/more_ico.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 2185
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:10 GMT
Server: nginx
Last-Modified: Thu, 07 Jun 2018 08:49:46 GMT
ETag: "5b18f1aa-889"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:5 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:7 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:3 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53070
X-Request-Id: 508a4f9f8bb5ad3d9cdbbee5ae640146
GET

http://www.4399.com/jss/playcoup.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/playcoup.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Content-Length: 1420
Connection: keep-alive
Expires: Tue, 07 Jan 2025 19:18:53 GMT
Server: nginx
Last-Modified: Wed, 09 Oct 2024 01:34:11 GMT
ETag: "6705dd93-58c"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:11 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53072
X-Request-Id: 937d7c91ceab86fe14f754a8ca60198e
GET

http://www.4399.com/jss/skiner27.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/skiner27.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 19:04:13 GMT
Server: nginx
Last-Modified: Tue, 15 Aug 2023 03:09:32 GMT
ETag: W/"64daec6c-11ac"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:6 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:8 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53075
X-Request-Id: 30a2718d05605ae8dddad96d7b06b073
GET

http://www.4399.com/images/xndbg.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/xndbg.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 129
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:10 GMT
Server: nginx
Last-Modified: Fri, 23 Aug 2019 10:41:15 GMT
ETag: "5d5fc2cb-81"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:14 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:22 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53079
X-Request-Id: 7e472297b8ec0b2847d9730971755d64
GET

http://www.4399.com/jss/lazyloading.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/lazyloading.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Content-Length: 1816
Connection: keep-alive
Expires: Tue, 07 Jan 2025 16:39:57 GMT
Server: nginx
Last-Modified: Wed, 20 Apr 2016 07:37:40 GMT
ETag: "571731c4-718"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:11 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:10 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53083
X-Request-Id: 0aa56b196141c15b30722a97a3fb47bf
GET

http://www.4399.com/antijs/age.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /antijs/age.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/x-javascript
Content-Length: 21
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:08 GMT
Server: nginx
Last-Modified: Tue, 18 Jul 2023 07:39:31 GMT
ETag: "64b641b3-15"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:13 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:22 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53086
X-Request-Id: 86884297dc8abaf6a091199eb62f8027
GET

http://www.4399.com/images/p2016/p-bg.jpg

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/p2016/p-bg.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/jpeg
Content-Length: 77053
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:12:09 GMT
Server: nginx
Last-Modified: Fri, 07 Apr 2017 05:51:08 GMT
ETag: "58e728cc-12cfd"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:5 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:3 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:17 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_48135-53088
X-Request-Id: 6264683f78eaa3e62f8d7495be73e4a1
GET

http://www.4399.com/js/4399stat.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /js/4399stat.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: application/x-javascript
Content-Length: 371
Connection: keep-alive
Expires: Wed, 09 Oct 2024 18:39:42 GMT
Server: nginx
Last-Modified: Sat, 05 Sep 2020 02:32:17 GMT
ETag: "5f52f8b1-173"
Cache-Control: max-age=3600
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:10 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:1 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_48135-53095
X-Request-Id: 6819fbbc71182c0f608a3cbbcf0a59bc
GET

http://www.4399.com/loadimg/iframe_action.htm

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /loadimg/iframe_action.htm HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: text/html
Content-Length: 1437
Connection: keep-alive
Expires: Wed, 09 Oct 2024 19:31:59 GMT
Server: nginx
Last-Modified: Wed, 09 Oct 2024 01:27:54 GMT
ETag: "6705dc1a-59d"
Cache-Control: max-age=1800
Accept-Ranges: bytes
Age: 5776
X-Via: 1.1 PSelsmskMOW3vl102:4 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:17 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_48135-53100
X-Request-Id: 83f744d251abdd14efe0520ed7a070e3
GET

http://www.4399.com/loadimg/noInstallFlashIE.html

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /loadimg/noInstallFlashIE.html HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:38:17 GMT
Server: nginx
Last-Modified: Sun, 29 Sep 2024 03:48:10 GMT
ETag: W/"66f8cdfa-ee0"
Cache-Control: max-age=7776000
Content-Encoding: gzip
X-Via: 1.1 PSelsmskMOW3vl102:3 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:0 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53245
X-Request-Id: 97138b57f37d2532242390e4c34fd9d4
GET

http://www.4399.com/httpsNot301/css/blockflashtip_20240423.css

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/css/blockflashtip_20240423.css HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:16:46 GMT
Server: nginx
Last-Modified: Wed, 24 Apr 2024 03:36:07 GMT
ETag: W/"66287e27-de0"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:7 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53260
X-Request-Id: 86d6c462542fd9321d28b4609ac142b7
GET

http://www.4399.com/httpsNot301/flashdist.js

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/flashdist.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: application/x-javascript
Content-Length: 1788
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:22 GMT
Server: nginx
Last-Modified: Wed, 09 Nov 2022 04:00:46 GMT
ETag: "636b25ee-6fc"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 12043483:13 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3cd100:10 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:8 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53264
X-Request-Id: 24072596dbbaa2177da6c2e3624f40c2
GET

http://www.4399.com/httpsNot301/blockflashtip_2022/iconTips.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/blockflashtip_2022/iconTips.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: image/png
Content-Length: 418
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:21 GMT
Server: nginx
Last-Modified: Fri, 04 Nov 2022 02:12:11 GMT
ETag: "636474fb-1a2"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 12043483:12 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:13 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:12 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53269
X-Request-Id: 3ed9ec3d63be2496f4b8b2f9f6ae9fc2
GET

http://www.4399.com/httpsNot301/new/close.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/new/close.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: image/png
Content-Length: 1749
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:22 GMT
Server: nginx
Last-Modified: Tue, 23 Apr 2024 02:35:09 GMT
ETag: "66271e5d-6d5"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:5 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:19 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53271
X-Request-Id: 9466639a7cbda1d90fadaaff8bcfc3c0
GET

http://www.4399.com/jss/unilogin_package.js?1018

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /jss/unilogin_package.js?1018 HTTP/1.1
Accept: */*
Referer: http://sbai.4399.com/4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: application/x-javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 17:08:42 GMT
Server: nginx
Last-Modified: Tue, 14 Dec 2021 07:28:19 GMT
ETag: W/"61b84793-1949"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3vl102:14 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53276
X-Request-Id: 5dfb04bf58682212dd0d208652723d16
GET

http://www.4399.com/httpsNot301/blockflashtip_2022/iconFlash.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/blockflashtip_2022/iconFlash.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: image/png
Content-Length: 737
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:29:21 GMT
Server: nginx
Last-Modified: Fri, 04 Nov 2022 02:12:10 GMT
ETag: "636474fa-2e1"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:0 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3cd100:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:2 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53277
X-Request-Id: 5672e3e0018196685c233b7b93a84302
GET

http://www.4399.com/httpsNot301/blockflashtip_2022/browserIcon-qq-big.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/blockflashtip_2022/browserIcon-qq-big.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:17 GMT
Content-Type: image/png
Content-Length: 2501
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:16:46 GMT
Server: nginx
Last-Modified: Mon, 07 Nov 2022 06:59:55 GMT
ETag: "6368aceb-9c5"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:0 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:8 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:21 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PS-LHR-01q9k95_48135-53279
X-Request-Id: 1979bd512644558d5164ffeca9d079fd
GET

http://www.4399.com/httpsNot301/blockflashtip_2022/browserIcon-sg-big.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /httpsNot301/blockflashtip_2022/browserIcon-sg-big.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:18 GMT
Content-Type: image/png
Content-Length: 2454
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:16:46 GMT
Server: nginx
Last-Modified: Mon, 07 Nov 2022 06:59:56 GMT
ETag: "6368acec-996"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:5 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:4 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9ba_PS-LHR-01q9k95_48135-53310
X-Request-Id: 31506b54391523af286f3512a878a38e
GET

http://www.4399.com/loadimg/age.htm?id=123456

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /loadimg/age.htm?id=123456 HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: text/html
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 09 Oct 2024 21:08:19 GMT
Server: nginx
Last-Modified: Wed, 22 Jun 2022 07:22:24 GMT
ETag: W/"62b2c330-9dc"
Cache-Control: max-age=1800
Content-Encoding: gzip
X-Via: 1.1 PSelsmskMOW3oa101:11 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:15 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_48135-53395
X-Request-Id: f9f43f22f28239307c3a16c2908fa22b
GET

http://www.4399.com/css/age.css

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /css/age.css HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Wed, 22 Jun 2022 05:40:18 GMT
ETag: W/"62b2ab42-107b"
Cache-Control: max-age=7776000
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PSelsmskMOW3oa101:6 (Cdn Cache Server V2.0), 1.1 PS-LHR-01q9k95:22 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_48135-53426
X-Request-Id: 2b6c6114b5d7f80db24e3feaf4f8b768
GET

http://www.4399.com/images/age/diaClose.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/age/diaClose.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: image/png
Content-Length: 372
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Mon, 16 May 2022 03:13:08 GMT
ETag: "6281c144-174"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:3 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:12 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:11 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_48135-53428
X-Request-Id: 69e1724ca43e2c158278713d858a45fc
GET

http://www.4399.com/images/age/ageLimit-tit.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/age/ageLimit-tit.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:19 GMT
Content-Type: image/png
Content-Length: 2971
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Mon, 16 May 2022 01:52:14 GMT
ETag: "6281ae4e-b9b"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:3 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:18 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bb_PS-LHR-01q9k95_48135-53431
X-Request-Id: 5369ef9967e1179ece194750d42ef909
GET

http://www.4399.com/images/age/ageLimit-logo.png

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /images/age/ageLimit-logo.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/age.htm?id=123456
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: www.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""; cookie_hs=4399.com%7C%7C%7C%u897F%u6E38%u6218%u8BB03%7C%7C123456_1%7C%7C0

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:20 GMT
Content-Type: image/png
Content-Length: 6005
Connection: keep-alive
Expires: Tue, 07 Jan 2025 20:10:42 GMT
Server: nginx
Last-Modified: Mon, 16 May 2022 01:51:58 GMT
ETag: "6281ae3e-1775"
Cache-Control: max-age=7776000
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK5bd29:3 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3oa101:11 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:13 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9bc_PS-LHR-01q9k95_48135-53433
X-Request-Id: 32ef1efbd8c569dafd0e5dd964dd5ba2
DNS

imga3.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

imga3.5054399.com

IN A

Response

imga3.5054399.com

IN CNAME

imga3.5054399.com.4399swf.com

imga3.5054399.com.4399swf.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190
DNS

imga.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

imga.5054399.com

IN A

Response

imga.5054399.com

IN CNAME

imga.5054399.com.4399swf.com

imga.5054399.com.4399swf.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190
DNS

imga4.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

imga4.5054399.com

IN A

Response

imga4.5054399.com

IN CNAME

imga4.5054399.com.4399swf.com

imga4.5054399.com.4399swf.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188
DNS

imga1.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

imga1.5054399.com

IN A

Response

imga1.5054399.com

IN CNAME

imga1.5054399.com.4399swf.com

imga1.5054399.com.4399swf.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190
DNS

imga2.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

imga2.5054399.com

IN A

Response

imga2.5054399.com

IN CNAME

imga2.5054399.com.4399swf.com

imga2.5054399.com.4399swf.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190
DNS

imga5.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

imga5.5054399.com

IN A

Response

imga5.5054399.com

IN CNAME

imga5.5054399.com.4399swf.com

imga5.5054399.com.4399swf.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188
DNS

ptlogin.3304399.net

սɱ.exe

Remote address:

8.8.8.8:53

Request

ptlogin.3304399.net

IN A

Response

ptlogin.3304399.net

IN CNAME

ptlogin.3304399.net.lxdns.com

ptlogin.3304399.net.lxdns.com

IN A

163.171.128.161

ptlogin.3304399.net.lxdns.com

IN A

163.171.146.64
GET

http://ptlogin.3304399.net/resource/css/base.css?20241092

սɱ.exe

Remote address:

163.171.128.161:80

Request

GET /resource/css/base.css?20241092 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: ptlogin.3304399.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 09 Oct 2024 21:17:00 GMT
Server: openresty
Last-Modified: Fri, 20 Sep 2024 02:00:28 GMT
ETag: "66ecd73c-f596"
Cache-Control: max-age=3600
Access-Control-Allow-Origin: http://zd.4399doc.com
Accept-Ranges: bytes
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PS-000-01aCP44:14 (Cdn Cache Server V2.0), 1.1 fra13:0 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_fra13_30531-6882
X-Server-Ip: 163.171.128.161
Access-Control-Expose-Headers: X-Server-Ip
GET

http://ptlogin.3304399.net/resource/ucenter.js?20241092

սɱ.exe

Remote address:

163.171.128.161:80

Request

GET /resource/ucenter.js?20241092 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: ptlogin.3304399.net
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:13 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Expires: Wed, 09 Oct 2024 21:17:01 GMT
Server: openresty
Last-Modified: Fri, 20 Sep 2024 02:00:28 GMT
ETag: "66ecd73c-18f16"
Cache-Control: max-age=3600
Access-Control-Allow-Origin: http://zd.4399doc.com
Accept-Ranges: bytes
Content-Encoding: gzip
Age: 1
X-Via: 1.1 PS-000-01aCP44:7 (Cdn Cache Server V2.0), 1.1 fra19:7 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b5_fra13_30531-6888
X-Server-Ip: 163.171.128.161
Access-Control-Expose-Headers: X-Server-Ip
GET

http://imga2.5054399.com/upload_pic/7272/4/37151.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/7272/4/37151.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 19 Apr 2012 02:13:12 GMT
Etag: "4f8f74b8-161b"
Server: openresty
Date: Mon, 22 Apr 2024 12:45:23 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 12:45:23 GMT
Cache-Control: max-age=31536000
Content-Length: 5659
Accept-Ranges: bytes
X-NWS-LOG-UUID: 6092402754709566481
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2012/6/11/4399_15041743040.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2012/6/11/4399_15041743040.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 11 Jun 2012 07:04:17 GMT
Etag: "4fd59871-d9b"
Server: openresty
Date: Mon, 03 Jun 2024 16:05:51 GMT
Content-Type: image/jpeg
Expires: Tue, 03 Jun 2025 16:05:51 GMT
Cache-Control: max-age=31536000
Content-Length: 3483
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15859475327527754135
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2013/8/30/4399_17073799381.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/8/30/4399_17073799381.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 30 Aug 2013 09:07:37 GMT
Etag: "522060d9-ecd"
Server: openresty
Date: Tue, 16 Jan 2024 16:27:00 GMT
Content-Type: image/jpeg
Expires: Wed, 15 Jan 2025 16:27:00 GMT
Cache-Control: max-age=31536000
Content-Length: 3789
Accept-Ranges: bytes
X-NWS-LOG-UUID: 12076759420818449007
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2020/9/16/4399_17074684634.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2020/9/16/4399_17074684634.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 16 Sep 2020 09:07:46 GMT
Etag: "5f61d5e2-11ac"
Server: openresty
Date: Mon, 22 Apr 2024 03:41:33 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 03:41:33 GMT
Cache-Control: max-age=31536000
Content-Length: 4524
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15604489484960663441
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2024/7/12/4399_15382598886.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/7/12/4399_15382598886.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 12 Jul 2024 07:38:25 GMT
Etag: "6690dd71-2263"
Server: openresty
Date: Fri, 12 Jul 2024 13:25:57 GMT
Content-Type: image/jpeg
Expires: Sat, 12 Jul 2025 13:25:57 GMT
Cache-Control: max-age=31536000
Content-Length: 8803
Accept-Ranges: bytes
X-NWS-LOG-UUID: 9024931490432316083
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2022/6/22/4399_14163082518.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2022/6/22/4399_14163082518.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/loading.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 22 Jun 2022 06:16:30 GMT
Etag: "62b2b3be-780a"
Server: openresty
Date: Wed, 08 May 2024 13:58:14 GMT
Content-Type: image/jpeg
Expires: Thu, 08 May 2025 13:58:14 GMT
Cache-Control: max-age=31536000
Content-Length: 30730
Accept-Ranges: bytes
X-NWS-LOG-UUID: 11806680919926701705
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/minilogo/123456.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/minilogo/123456.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 18 Sep 2024 19:31:01 GMT
Etag: "66eb2a75-8e3"
Server: openresty
Date: Mon, 23 Sep 2024 21:11:34 GMT
Content-Type: image/jpeg
Expires: Tue, 23 Sep 2025 21:11:34 GMT
Cache-Control: max-age=31536000
Content-Length: 2275
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5758968876916471918
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2023/9/28/4399_10461843815.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2023/9/28/4399_10461843815.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 28 Sep 2023 02:46:18 GMT
Etag: "6514e8fa-11e9"
Server: openresty
Date: Sun, 23 Jun 2024 09:57:01 GMT
Content-Type: image/jpeg
Expires: Mon, 23 Jun 2025 09:57:01 GMT
Cache-Control: max-age=31536000
Content-Length: 4585
Accept-Ranges: bytes
X-NWS-LOG-UUID: 8933931119400237426
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2024/9/26/4399_16342426278.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/9/26/4399_16342426278.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 26 Sep 2024 08:34:24 GMT
Etag: "66f51c90-143b"
Server: openresty
Date: Thu, 26 Sep 2024 09:40:05 GMT
Content-Type: image/jpeg
Expires: Fri, 26 Sep 2025 09:40:05 GMT
Cache-Control: max-age=31536000
Content-Length: 5179
Accept-Ranges: bytes
X-NWS-LOG-UUID: 18108083462256816800
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2024/7/5/4399_12374219801.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/7/5/4399_12374219801.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 05 Jul 2024 04:37:42 GMT
Etag: "66877896-2010"
Server: openresty
Date: Fri, 05 Jul 2024 10:02:07 GMT
Content-Type: image/jpeg
Expires: Sat, 05 Jul 2025 10:02:07 GMT
Cache-Control: max-age=31536000
Content-Length: 8208
Accept-Ranges: bytes
X-NWS-LOG-UUID: 17490803778550808117
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/7272/5/40921.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/7272/5/40921.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 07 May 2012 12:46:36 GMT
Etag: "4fa7c42c-16f5"
Server: openresty
Date: Fri, 10 May 2024 17:38:34 GMT
Content-Type: image/jpeg
Expires: Sat, 10 May 2025 17:38:34 GMT
Cache-Control: max-age=31536000
Content-Length: 5877
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2334080274085427817
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2013/9/28/4399_13520493927.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/9/28/4399_13520493927.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Sat, 28 Sep 2013 05:52:04 GMT
Etag: "52466e84-13d4"
Server: openresty
Date: Sun, 28 Jan 2024 23:43:27 GMT
Content-Type: image/jpeg
Expires: Mon, 27 Jan 2025 23:43:27 GMT
Cache-Control: max-age=31536000
Content-Length: 5076
Accept-Ranges: bytes
X-NWS-LOG-UUID: 10636076378081595628
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2024/9/9/4399_16551217162.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/9/9/4399_16551217162.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 09 Sep 2024 08:55:12 GMT
Etag: "66deb7f0-143b"
Server: openresty
Date: Mon, 09 Sep 2024 11:39:31 GMT
Content-Type: image/jpeg
Expires: Tue, 09 Sep 2025 11:39:31 GMT
Cache-Control: max-age=31536000
Content-Length: 5179
Accept-Ranges: bytes
X-NWS-LOG-UUID: 12759745002775349405
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga2.5054399.com/upload_pic/2024/3/1/4399_17225675210.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/3/1/4399_17225675210.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga2.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 01 Mar 2024 09:22:56 GMT
Etag: "65e19e70-1380"
Server: openresty
Date: Fri, 01 Mar 2024 10:49:36 GMT
Content-Type: image/jpeg
Expires: Sat, 01 Mar 2025 10:49:36 GMT
Cache-Control: max-age=31536000
Content-Length: 4992
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15284391731916272393
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2016/4/18/4399_10515806953.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2016/4/18/4399_10515806953.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 18 Apr 2016 02:51:58 GMT
Etag: "57144bce-1424"
Server: openresty
Date: Fri, 26 Apr 2024 21:03:33 GMT
Content-Type: image/jpeg
Expires: Sat, 26 Apr 2025 21:03:33 GMT
Cache-Control: max-age=31536000
Content-Length: 5156
Accept-Ranges: bytes
X-NWS-LOG-UUID: 908318931408615689
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/7272/8/77745.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/7272/8/77745.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 07 May 2012 09:23:32 GMT
Etag: "4fa79494-10c5"
Server: openresty
Date: Mon, 03 Jun 2024 16:05:53 GMT
Content-Type: image/jpeg
Expires: Tue, 03 Jun 2025 16:05:53 GMT
Cache-Control: max-age=31536000
Content-Length: 4293
Accept-Ranges: bytes
X-NWS-LOG-UUID: 295525938549891499
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2013/6/6/4399_15495613950.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/6/6/4399_15495613950.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 06 Jun 2013 07:49:56 GMT
Etag: "51b03f24-b0d"
Server: openresty
Date: Mon, 03 Jun 2024 16:05:52 GMT
Content-Type: image/jpeg
Expires: Tue, 03 Jun 2025 16:05:52 GMT
Cache-Control: max-age=31536000
Content-Length: 2829
Accept-Ranges: bytes
X-NWS-LOG-UUID: 8283813710148860599
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/7272/7/66920.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/7272/7/66920.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 09 May 2012 08:53:06 GMT
Etag: "4faa3072-db8"
Server: openresty
Date: Fri, 31 May 2024 17:22:06 GMT
Content-Type: image/jpeg
Expires: Sat, 31 May 2025 17:22:06 GMT
Cache-Control: max-age=31536000
Content-Length: 3512
Accept-Ranges: bytes
X-NWS-LOG-UUID: 3776526648253392033
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2023/9/28/4399_11400644897.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2023/9/28/4399_11400644897.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 28 Sep 2023 03:40:06 GMT
Etag: "6514f596-11ef"
Server: openresty
Date: Tue, 23 Jul 2024 10:24:54 GMT
Content-Type: image/jpeg
Expires: Wed, 23 Jul 2025 10:24:54 GMT
Cache-Control: max-age=31536000
Content-Length: 4591
Accept-Ranges: bytes
X-NWS-LOG-UUID: 6298486505946945951
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2014/7/26/4399_16192154669.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2014/7/26/4399_16192154669.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Sat, 26 Jul 2014 08:19:21 GMT
Etag: "53d36489-13ab"
Server: openresty
Date: Fri, 29 Dec 2023 20:42:41 GMT
Content-Type: image/jpeg
Expires: Sat, 28 Dec 2024 20:42:41 GMT
Cache-Control: max-age=31536000
Content-Length: 5035
Accept-Ranges: bytes
X-NWS-LOG-UUID: 10940723529730443169
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2019/8/8/4399_11000180171.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2019/8/8/4399_11000180171.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 08 Aug 2019 03:00:01 GMT
Etag: "5d4b9031-ffb"
Server: openresty
Date: Thu, 14 Dec 2023 15:48:05 GMT
Content-Type: image/jpeg
Expires: Fri, 13 Dec 2024 15:48:05 GMT
Cache-Control: max-age=31536000
Content-Length: 4091
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2882421176250552530
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2024/1/17/4399_15185234953.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/1/17/4399_15185234953.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 17 Jan 2024 07:18:52 GMT
Etag: "65a77f5c-2e03"
Server: openresty
Date: Wed, 08 May 2024 15:13:19 GMT
Content-Type: image/jpeg
Expires: Thu, 08 May 2025 15:13:19 GMT
Cache-Control: max-age=31536000
Content-Length: 11779
Accept-Ranges: bytes
X-NWS-LOG-UUID: 17680311112308426250
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2021/11/17/4399_09480196660.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2021/11/17/4399_09480196660.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 17 Nov 2021 01:48:01 GMT
Etag: "61945f51-109c"
Server: openresty
Date: Wed, 27 Dec 2023 14:46:52 GMT
Content-Type: image/jpeg
Expires: Thu, 26 Dec 2024 14:46:52 GMT
Cache-Control: max-age=31536000
Content-Length: 4252
Accept-Ranges: bytes
X-NWS-LOG-UUID: 14903838657232550702
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2013/1/15/4399_16090213522.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/1/15/4399_16090213522.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 15 Jan 2013 08:09:02 GMT
Etag: "50f50e9e-fbe"
Server: openresty
Date: Thu, 09 May 2024 15:22:53 GMT
Content-Type: image/jpeg
Expires: Fri, 09 May 2025 15:22:53 GMT
Cache-Control: max-age=31536000
Content-Length: 4030
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2176555420252823060
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/7272/4/38230.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/7272/4/38230.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 09 May 2012 08:57:40 GMT
Etag: "4faa3184-14bf"
Server: openresty
Date: Mon, 24 Jun 2024 22:56:24 GMT
Content-Type: image/jpeg
Expires: Tue, 24 Jun 2025 22:56:24 GMT
Cache-Control: max-age=31536000
Content-Length: 5311
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5111420627764909170
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2013/9/16/4399_16325143503.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/9/16/4399_16325143503.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 16 Sep 2013 08:32:51 GMT
Etag: "5236c233-137b"
Server: openresty
Date: Thu, 25 Jul 2024 12:20:52 GMT
Content-Type: image/jpeg
Expires: Fri, 25 Jul 2025 12:20:52 GMT
Cache-Control: max-age=31536000
Content-Length: 4987
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4479025675842898974
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2012/10/18/4399_11100951416.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2012/10/18/4399_11100951416.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 18 Oct 2012 03:10:09 GMT
Etag: "507f7311-f1f"
Server: openresty
Date: Sun, 17 Mar 2024 18:40:34 GMT
Content-Type: image/jpeg
Expires: Mon, 17 Mar 2025 18:40:34 GMT
Cache-Control: max-age=31536000
Content-Length: 3871
Accept-Ranges: bytes
X-NWS-LOG-UUID: 8862958284338679903
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2021/1/12/4399_11293298167.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2021/1/12/4399_11293298167.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Jan 2021 03:29:32 GMT
Etag: "5ffd179c-1255"
Server: openresty
Date: Mon, 22 Apr 2024 04:35:22 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 04:35:22 GMT
Cache-Control: max-age=31536000
Content-Length: 4693
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4928584082596182041
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2024/9/11/4399_16110796047.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/9/11/4399_16110796047.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 11 Sep 2024 08:11:07 GMT
Etag: "66e1509b-2794"
Server: openresty
Date: Wed, 11 Sep 2024 08:33:38 GMT
Content-Type: image/jpeg
Expires: Thu, 11 Sep 2025 08:33:38 GMT
Cache-Control: max-age=31536000
Content-Length: 10132
Accept-Ranges: bytes
X-NWS-LOG-UUID: 17891859493590491624
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2023/11/22/4399_10381421104.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2023/11/22/4399_10381421104.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 22 Nov 2023 02:38:14 GMT
Etag: "655d6996-f02"
Server: openresty
Date: Tue, 18 Jun 2024 15:04:46 GMT
Content-Type: image/jpeg
Expires: Wed, 18 Jun 2025 15:04:46 GMT
Cache-Control: max-age=31536000
Content-Length: 3842
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2618815079422902333
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga1.5054399.com/upload_pic/2024/9/27/4399_18054269006.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/9/27/4399_18054269006.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga1.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 27 Sep 2024 10:05:42 GMT
Etag: "66f68376-1c61"
Server: openresty
Date: Fri, 27 Sep 2024 10:10:28 GMT
Content-Type: image/jpeg
Expires: Sat, 27 Sep 2025 10:10:28 GMT
Cache-Control: max-age=31536000
Content-Length: 7265
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4333587410289531463
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/2016/2/29/4399_16202750741.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2016/2/29/4399_16202750741.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 29 Feb 2016 08:20:27 GMT
Etag: "56d3ff4b-e0e"
Server: openresty
Date: Tue, 23 Jul 2024 17:09:33 GMT
Content-Type: image/jpeg
Expires: Wed, 23 Jul 2025 17:09:33 GMT
Cache-Control: max-age=31536000
Content-Length: 3598
Accept-Ranges: bytes
X-NWS-LOG-UUID: 14615732428756085394
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/2014/3/6/4399_17214233822.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2014/3/6/4399_17214233822.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 06 Mar 2014 09:21:42 GMT
Etag: "53183e26-134c"
Server: openresty
Date: Thu, 01 Feb 2024 15:34:12 GMT
Content-Type: image/jpeg
Expires: Fri, 31 Jan 2025 15:34:12 GMT
Cache-Control: max-age=31536000
Content-Length: 4940
Accept-Ranges: bytes
X-NWS-LOG-UUID: 76489147374462324
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/7272/2/11938.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/7272/2/11938.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 16 Apr 2012 11:11:02 GMT
Etag: "4f8bfe46-13db"
Server: openresty
Date: Thu, 01 Feb 2024 15:35:58 GMT
Content-Type: image/jpeg
Expires: Fri, 31 Jan 2025 15:35:58 GMT
Cache-Control: max-age=31536000
Content-Length: 5083
Accept-Ranges: bytes
X-NWS-LOG-UUID: 6290094430702343800
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/2024/8/13/4399_14394822761.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/8/13/4399_14394822761.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 13 Aug 2024 06:39:48 GMT
Etag: "66baffb4-2539"
Server: openresty
Date: Tue, 13 Aug 2024 09:03:48 GMT
Content-Type: image/jpeg
Expires: Wed, 13 Aug 2025 09:03:48 GMT
Cache-Control: max-age=31536000
Content-Length: 9529
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5891470037565086722
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2020/9/18/4399_15004677609.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2020/9/18/4399_15004677609.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 18 Sep 2020 07:00:46 GMT
Etag: "5f645b1e-12ee"
Server: openresty
Date: Mon, 22 Apr 2024 23:54:00 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 23:54:00 GMT
Cache-Control: max-age=31536000
Content-Length: 4846
Accept-Ranges: bytes
X-NWS-LOG-UUID: 14004082936409846864
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2013/1/18/4399_19133429371.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/1/18/4399_19133429371.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 18 Jan 2013 11:13:34 GMT
Etag: "50f92e5e-10ea"
Server: openresty
Date: Fri, 26 Jan 2024 07:10:05 GMT
Content-Type: image/jpeg
Expires: Sat, 25 Jan 2025 07:10:05 GMT
Cache-Control: max-age=31536000
Content-Length: 4330
Accept-Ranges: bytes
X-NWS-LOG-UUID: 7140328731059144054
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2013/11/14/4399_11454656379.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/11/14/4399_11454656379.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 14 Nov 2013 03:45:46 GMT
Etag: "5284476a-13c2"
Server: openresty
Date: Sat, 06 Apr 2024 19:13:15 GMT
Content-Type: image/jpeg
Expires: Sun, 06 Apr 2025 19:13:15 GMT
Cache-Control: max-age=31536000
Content-Length: 5058
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15201130316593886200
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2016/2/19/4399_15264030803.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2016/2/19/4399_15264030803.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 19 Feb 2016 07:26:40 GMT
Etag: "56c6c3b0-137b"
Server: openresty
Date: Mon, 22 Apr 2024 17:27:31 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 17:27:31 GMT
Cache-Control: max-age=31536000
Content-Length: 4987
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5515151357196196694
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/7272/9/1232.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/7272/9/1232.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 14 May 2012 05:58:30 GMT
Etag: "4fb09f06-d2c"
Server: openresty
Date: Mon, 22 Apr 2024 17:27:37 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 17:27:37 GMT
Cache-Control: max-age=31536000
Content-Length: 3372
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2596339783206575227
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2024/9/11/4399_17044958903.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/9/11/4399_17044958903.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 11 Sep 2024 09:04:49 GMT
Etag: "66e15d31-2167"
Server: openresty
Date: Wed, 11 Sep 2024 10:33:26 GMT
Content-Type: image/jpeg
Expires: Thu, 11 Sep 2025 10:33:26 GMT
Cache-Control: max-age=31536000
Content-Length: 8551
Accept-Ranges: bytes
X-NWS-LOG-UUID: 10564932095618948384
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2021/10/12/4399_19114079011.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2021/10/12/4399_19114079011.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Oct 2021 11:11:40 GMT
Etag: "61656d6c-14bc"
Server: openresty
Date: Wed, 08 May 2024 12:21:50 GMT
Content-Type: image/jpeg
Expires: Thu, 08 May 2025 12:21:50 GMT
Cache-Control: max-age=31536000
Content-Length: 5308
Accept-Ranges: bytes
X-NWS-LOG-UUID: 8484471734585191109
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2021/2/3/4399_15125506077.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2021/2/3/4399_15125506077.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 03 Feb 2021 07:12:55 GMT
Etag: "601a4cf7-144b"
Server: openresty
Date: Fri, 10 May 2024 09:31:45 GMT
Content-Type: image/jpeg
Expires: Sat, 10 May 2025 09:31:45 GMT
Cache-Control: max-age=31536000
Content-Length: 5195
Accept-Ranges: bytes
X-NWS-LOG-UUID: 14349721012533678409
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2013/3/18/4399_09532349388.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/3/18/4399_09532349388.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 18 Mar 2013 01:53:23 GMT
Etag: "51467393-11b3"
Server: openresty
Date: Mon, 18 Dec 2023 19:44:52 GMT
Content-Type: image/jpeg
Expires: Tue, 17 Dec 2024 19:44:52 GMT
Cache-Control: max-age=31536000
Content-Length: 4531
Accept-Ranges: bytes
X-NWS-LOG-UUID: 7548613258794701180
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2024/7/10/4399_14565164570.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/7/10/4399_14565164570.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 10 Jul 2024 06:56:51 GMT
Etag: "668e30b3-141d"
Server: openresty
Date: Wed, 10 Jul 2024 20:04:52 GMT
Content-Type: image/jpeg
Expires: Thu, 10 Jul 2025 20:04:52 GMT
Cache-Control: max-age=31536000
Content-Length: 5149
Accept-Ranges: bytes
X-NWS-LOG-UUID: 10035384222768536264
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2021/2/8/4399_14260278402.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2021/2/8/4399_14260278402.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 08 Feb 2021 06:26:02 GMT
Etag: "6020d97a-11ed"
Server: openresty
Date: Tue, 23 Jul 2024 11:36:08 GMT
Content-Type: image/jpeg
Expires: Wed, 23 Jul 2025 11:36:08 GMT
Cache-Control: max-age=31536000
Content-Length: 4589
Accept-Ranges: bytes
X-NWS-LOG-UUID: 8559416022590268678
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2013/5/16/4399_11483168018.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/5/16/4399_11483168018.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 16 May 2013 03:48:31 GMT
Etag: "5194570f-1105"
Server: openresty
Date: Fri, 10 May 2024 19:16:02 GMT
Content-Type: image/jpeg
Expires: Sat, 10 May 2025 19:16:02 GMT
Cache-Control: max-age=31536000
Content-Length: 4357
Accept-Ranges: bytes
X-NWS-LOG-UUID: 1436030701816976770
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2023/9/28/4399_14134793184.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2023/9/28/4399_14134793184.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 28 Sep 2023 06:13:47 GMT
Etag: "6515199b-137e"
Server: openresty
Date: Wed, 27 Dec 2023 14:47:02 GMT
Content-Type: image/jpeg
Expires: Thu, 26 Dec 2024 14:47:02 GMT
Cache-Control: max-age=31536000
Content-Length: 4990
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15031760991757162533
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2024/9/4/4399_15574975968.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/9/4/4399_15574975968.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 04 Sep 2024 07:57:49 GMT
Etag: "66d812fd-12e1"
Server: openresty
Date: Wed, 04 Sep 2024 08:52:54 GMT
Content-Type: image/jpeg
Expires: Thu, 04 Sep 2025 08:52:54 GMT
Cache-Control: max-age=31536000
Content-Length: 4833
Accept-Ranges: bytes
X-NWS-LOG-UUID: 12157543460790690928
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga3.5054399.com/upload_pic/2016/2/18/4399_18432063237.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2016/2/18/4399_18432063237.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga3.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 18 Feb 2016 10:43:20 GMT
Etag: "56c5a048-1161"
Server: openresty
Date: Thu, 14 Dec 2023 09:43:43 GMT
Content-Type: image/jpeg
Expires: Fri, 13 Dec 2024 09:43:43 GMT
Cache-Control: max-age=31536000
Content-Length: 4449
Accept-Ranges: bytes
X-NWS-LOG-UUID: 9207370473322365822
Connection: keep-alive
X-Cache-Lookup: Cache Hit
DNS

sbai.4399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

sbai.4399.com

IN A

Response

sbai.4399.com

IN CNAME

sbai.4399.com.4399hhh.com

sbai.4399.com.4399hhh.com

IN CNAME

s9.4399swf.com

s9.4399swf.com

IN CNAME

s5.4399.com.lg.cdn.dnsv1.com

s5.4399.com.lg.cdn.dnsv1.com

IN CNAME

4399.ovslegodl.sched.ovscdns.com

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.188

4399.ovslegodl.sched.ovscdns.com

IN A

43.132.64.190
GET

http://imga4.5054399.com/upload_pic/7272/1/7523.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/7272/1/7523.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 03 Apr 2012 07:43:30 GMT
Etag: "4f7aaa22-11da"
Server: openresty
Date: Thu, 28 Mar 2024 11:15:23 GMT
Content-Type: image/jpeg
Expires: Fri, 28 Mar 2025 11:15:23 GMT
Cache-Control: max-age=31536000
Content-Length: 4570
Accept-Ranges: bytes
X-NWS-LOG-UUID: 14457916452519479654
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/2013/9/13/4399_16440175488.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2013/9/13/4399_16440175488.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 13 Sep 2013 08:44:01 GMT
Etag: "5232d051-140b"
Server: openresty
Date: Thu, 25 Jul 2024 12:20:51 GMT
Content-Type: image/jpeg
Expires: Fri, 25 Jul 2025 12:20:51 GMT
Cache-Control: max-age=31536000
Content-Length: 5131
Accept-Ranges: bytes
X-NWS-LOG-UUID: 9358479976683833681
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/2023/9/28/4399_14144905869.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2023/9/28/4399_14144905869.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 28 Sep 2023 06:14:49 GMT
Etag: "651519d9-1419"
Server: openresty
Date: Mon, 22 Apr 2024 02:55:03 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 02:55:03 GMT
Cache-Control: max-age=31536000
Content-Length: 5145
Accept-Ranges: bytes
X-NWS-LOG-UUID: 1115789297883742696
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga4.5054399.com/upload_pic/2022/10/20/4399_16333396421.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2022/10/20/4399_16333396421.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga4.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 20 Oct 2022 08:33:33 GMT
Etag: "635107dd-1384"
Server: openresty
Date: Fri, 10 May 2024 09:32:12 GMT
Content-Type: image/jpeg
Expires: Sat, 10 May 2025 09:32:12 GMT
Cache-Control: max-age=31536000
Content-Length: 4996
Accept-Ranges: bytes
X-NWS-LOG-UUID: 8002693605348532661
Connection: keep-alive
X-Cache-Lookup: Cache Hit
DNS

newsimg.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

newsimg.5054399.com

IN A

Response

newsimg.5054399.com

IN CNAME

newsimg.5054399.com.4399swf.com

newsimg.5054399.com.4399swf.com

IN CNAME

s5.4399.com.lxdns.com

s5.4399.com.lxdns.com

IN A

138.113.149.152

s5.4399.com.lxdns.com

IN A

163.171.129.134

s5.4399.com.lxdns.com

IN A

174.35.118.62

s5.4399.com.lxdns.com

IN A

174.35.118.63
DNS

4399stat.5054399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

4399stat.5054399.com

IN A

Response

4399stat.5054399.com

IN CNAME

4399stat.5054399.com.lxdns.com

4399stat.5054399.com.lxdns.com

IN A

174.35.118.62

4399stat.5054399.com.lxdns.com

IN A

163.171.129.134

4399stat.5054399.com.lxdns.com

IN A

174.35.118.63

4399stat.5054399.com.lxdns.com

IN A

163.171.146.42
DNS

s4.img4399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

s4.img4399.com

IN A

Response

s4.img4399.com

IN CNAME

s4.img4399.com.lxdns.com

s4.img4399.com.lxdns.com

IN A

174.35.118.63

s4.img4399.com.lxdns.com

IN A

163.171.146.42

s4.img4399.com.lxdns.com

IN A

163.171.129.134

s4.img4399.com.lxdns.com

IN A

174.35.118.62
GET

http://imga.5054399.com/upload_pic/2013/5/7/4399_14253243523.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2013/5/7/4399_14253243523.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 07 May 2013 06:25:32 GMT
Etag: "51889e5c-1266"
Server: openresty
Date: Mon, 22 Jan 2024 21:56:38 GMT
Content-Type: image/jpeg
Expires: Tue, 21 Jan 2025 21:56:38 GMT
Cache-Control: max-age=31536000
Content-Length: 4710
Accept-Ranges: bytes
X-NWS-LOG-UUID: 10676003693298749563
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga.5054399.com/upload_pic/2024/10/9/4399_09215957460.gif

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/10/9/4399_09215957460.gif HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/loading.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 09 Oct 2024 01:21:59 GMT
Etag: "6705dab7-83c5"
Server: openresty
Date: Wed, 09 Oct 2024 01:38:53 GMT
Content-Type: image/gif
Expires: Thu, 09 Oct 2025 01:38:53 GMT
Cache-Control: max-age=31536000
Content-Length: 33733
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4249542940651974609
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga.5054399.com/upload_pic/2024/6/11/4399_14375730684.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2024/6/11/4399_14375730684.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 11 Jun 2024 06:37:57 GMT
Etag: "6667f0c5-7453"
Server: openresty
Date: Wed, 12 Jun 2024 01:34:09 GMT
Content-Type: image/jpeg
Expires: Thu, 12 Jun 2025 01:34:09 GMT
Cache-Control: max-age=31536000
Content-Length: 29779
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4595787664729857535
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga.5054399.com/upload_pic/2023/12/5/4399_13553984400.jpg

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /upload_pic/2023/12/5/4399_13553984400.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/noInstallFlashIE.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 05 Dec 2023 05:55:39 GMT
Etag: "656ebb5b-3de6"
Server: openresty
Date: Thu, 14 Dec 2023 06:23:56 GMT
Content-Type: image/jpeg
Expires: Fri, 13 Dec 2024 06:23:56 GMT
Cache-Control: max-age=31536000
Content-Length: 15846
Accept-Ranges: bytes
X-NWS-LOG-UUID: 17107602873722551515
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://s4.img4399.com/cg/resource/js/api/gprp.js?2013

սɱ.exe

Remote address:

174.35.118.63:80

Request

GET /cg/resource/js/api/gprp.js?2013 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: s4.img4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: application/javascript
Content-Length: 13638
Connection: keep-alive
Expires: Fri, 25 Oct 2024 08:12:04 GMT
Server: nginx
apm_traceid: Ignored_Trace
Last-Modified: Wed, 04 Sep 2024 01:43:29 GMT
Accept-Ranges: bytes
Cache-Control: max-age=2592000
Age: 1
X-Via: 1.1 PSelsmskMOW3cd100:11 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:20 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_47019-46799
Access-Control-Expose-Headers: X-Server-Ip
X-Server-Ip: 174.35.118.63
GET

http://imga5.5054399.com/upload_pic/2019/8/23/4399_11432738662.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2019/8/23/4399_11432738662.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 23 Aug 2019 03:43:27 GMT
Etag: "5d5f60df-11d1"
Server: openresty
Date: Thu, 14 Dec 2023 19:28:17 GMT
Content-Type: image/jpeg
Expires: Fri, 13 Dec 2024 19:28:17 GMT
Cache-Control: max-age=31536000
Content-Length: 4561
Accept-Ranges: bytes
X-NWS-LOG-UUID: 4613698321598942355
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2012/4/21/4399_15161199933.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2012/4/21/4399_15161199933.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Sat, 21 Apr 2012 07:16:11 GMT
Etag: "4f925ebb-1388"
Server: openresty
Date: Tue, 25 Jun 2024 00:50:06 GMT
Content-Type: image/jpeg
Expires: Wed, 25 Jun 2025 00:50:06 GMT
Cache-Control: max-age=31536000
Content-Length: 5000
Accept-Ranges: bytes
X-NWS-LOG-UUID: 3977758569306255730
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2013/11/20/4399_14214382641.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2013/11/20/4399_14214382641.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 20 Nov 2013 06:21:43 GMT
Etag: "528c54f7-132f"
Server: openresty
Date: Mon, 03 Jun 2024 16:05:52 GMT
Content-Type: image/jpeg
Expires: Tue, 03 Jun 2025 16:05:52 GMT
Cache-Control: max-age=31536000
Content-Length: 4911
Accept-Ranges: bytes
X-NWS-LOG-UUID: 12205512192809569440
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2016/2/23/4399_20255017634.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2016/2/23/4399_20255017634.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 23 Feb 2016 12:25:50 GMT
Etag: "56cc4fce-8f4"
Server: openresty
Date: Fri, 26 Jan 2024 11:26:23 GMT
Content-Type: image/jpeg
Expires: Sat, 25 Jan 2025 11:26:23 GMT
Cache-Control: max-age=31536000
Content-Length: 2292
Accept-Ranges: bytes
X-NWS-LOG-UUID: 16517631434515158869
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2016/2/23/4399_19500754537.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2016/2/23/4399_19500754537.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 23 Feb 2016 11:50:07 GMT
Etag: "56cc476f-d48"
Server: openresty
Date: Fri, 26 Jan 2024 09:27:03 GMT
Content-Type: image/jpeg
Expires: Sat, 25 Jan 2025 09:27:03 GMT
Cache-Control: max-age=31536000
Content-Length: 3400
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2486117606375703955
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2024/9/20/4399_15320883287.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/9/20/4399_15320883287.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 20 Sep 2024 07:32:08 GMT
Etag: "66ed24f8-1b7a"
Server: openresty
Date: Fri, 20 Sep 2024 07:48:30 GMT
Content-Type: image/jpeg
Expires: Sat, 20 Sep 2025 07:48:30 GMT
Cache-Control: max-age=31536000
Content-Length: 7034
Accept-Ranges: bytes
X-NWS-LOG-UUID: 14066506040672074402
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2023/11/1/4399_10260731958.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2023/11/1/4399_10260731958.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 01 Nov 2023 02:26:07 GMT
Etag: "6541b73f-1c0f"
Server: openresty
Date: Tue, 18 Jun 2024 15:04:47 GMT
Content-Type: image/jpeg
Expires: Wed, 18 Jun 2025 15:04:47 GMT
Cache-Control: max-age=31536000
Content-Length: 7183
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15642725429416655510
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2024/1/16/4399_13522128559.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/1/16/4399_13522128559.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 16 Jan 2024 05:52:21 GMT
Etag: "65a61995-2081"
Server: openresty
Date: Tue, 16 Jan 2024 17:07:15 GMT
Content-Type: image/jpeg
Expires: Wed, 15 Jan 2025 17:07:15 GMT
Cache-Control: max-age=31536000
Content-Length: 8321
Accept-Ranges: bytes
X-NWS-LOG-UUID: 12522804757037505636
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2023/4/7/4399_15413094698.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2023/4/7/4399_15413094698.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 07 Apr 2023 07:41:30 GMT
Etag: "642fc92a-2661"
Server: openresty
Date: Fri, 26 Apr 2024 12:44:18 GMT
Content-Type: image/jpeg
Expires: Sat, 26 Apr 2025 12:44:18 GMT
Cache-Control: max-age=31536000
Content-Length: 9825
Accept-Ranges: bytes
X-NWS-LOG-UUID: 3313738466330225045
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2020/5/20/4399_09324294709.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2020/5/20/4399_09324294709.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 20 May 2020 01:32:42 GMT
Etag: "5ec488ba-1474"
Server: openresty
Date: Mon, 22 Apr 2024 08:08:40 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 08:08:40 GMT
Cache-Control: max-age=31536000
Content-Length: 5236
Accept-Ranges: bytes
X-NWS-LOG-UUID: 2570469147543854691
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2016/2/17/4399_16081405239.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2016/2/17/4399_16081405239.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 17 Feb 2016 08:08:14 GMT
Etag: "56c42a6e-13ae"
Server: openresty
Date: Thu, 14 Dec 2023 06:29:54 GMT
Content-Type: image/jpeg
Expires: Fri, 13 Dec 2024 06:29:54 GMT
Cache-Control: max-age=31536000
Content-Length: 5038
Accept-Ranges: bytes
X-NWS-LOG-UUID: 5972480255774487100
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2014/4/14/4399_16123010721.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2014/4/14/4399_16123010721.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 14 Apr 2014 08:12:30 GMT
Etag: "534b986e-13cf"
Server: openresty
Date: Thu, 09 May 2024 19:34:54 GMT
Content-Type: image/jpeg
Expires: Fri, 09 May 2025 19:34:54 GMT
Cache-Control: max-age=31536000
Content-Length: 5071
Accept-Ranges: bytes
X-NWS-LOG-UUID: 11555526549768058971
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/7272/5/41119.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/7272/5/41119.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 26 Mar 2012 03:51:18 GMT
Etag: "4f6fe7b6-f4b"
Server: openresty
Date: Thu, 09 May 2024 19:34:54 GMT
Content-Type: image/jpeg
Expires: Fri, 09 May 2025 19:34:54 GMT
Cache-Control: max-age=31536000
Content-Length: 3915
Accept-Ranges: bytes
X-NWS-LOG-UUID: 3228199438240821745
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2012/9/10/4399_14455835923.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2012/9/10/4399_14455835923.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Mon, 10 Sep 2012 06:45:58 GMT
Etag: "504d8ca6-c25"
Server: openresty
Date: Sun, 17 Mar 2024 18:40:35 GMT
Content-Type: image/jpeg
Expires: Mon, 17 Mar 2025 18:40:35 GMT
Cache-Control: max-age=31536000
Content-Length: 3109
Accept-Ranges: bytes
X-NWS-LOG-UUID: 7474376545790651495
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2016/2/19/4399_15071153648.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2016/2/19/4399_15071153648.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 19 Feb 2016 07:07:11 GMT
Etag: "56c6bf1f-13d2"
Server: openresty
Date: Wed, 27 Dec 2023 18:34:15 GMT
Content-Type: image/jpeg
Expires: Thu, 26 Dec 2024 18:34:15 GMT
Cache-Control: max-age=31536000
Content-Length: 5074
Accept-Ranges: bytes
X-NWS-LOG-UUID: 11902614087163886146
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2024/1/17/4399_10264901544.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/1/17/4399_10264901544.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 17 Jan 2024 02:26:49 GMT
Etag: "65a73ae9-1545"
Server: openresty
Date: Wed, 17 Jan 2024 10:04:52 GMT
Content-Type: image/jpeg
Expires: Thu, 16 Jan 2025 10:04:52 GMT
Cache-Control: max-age=31536000
Content-Length: 5445
Accept-Ranges: bytes
X-NWS-LOG-UUID: 304503896246334701
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2024/9/20/4399_11513472760.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/9/20/4399_11513472760.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Fri, 20 Sep 2024 03:51:34 GMT
Etag: "66ecf146-1959"
Server: openresty
Date: Fri, 20 Sep 2024 07:48:30 GMT
Content-Type: image/jpeg
Expires: Sat, 20 Sep 2025 07:48:30 GMT
Cache-Control: max-age=31536000
Content-Length: 6489
Accept-Ranges: bytes
X-NWS-LOG-UUID: 763640324496812585
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2024/3/12/4399_09120577908.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/3/12/4399_09120577908.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Tue, 12 Mar 2024 01:12:05 GMT
Etag: "65efabe5-12dc"
Server: openresty
Date: Wed, 08 May 2024 12:07:36 GMT
Content-Type: image/jpeg
Expires: Thu, 08 May 2025 12:07:36 GMT
Cache-Control: max-age=31536000
Content-Length: 4828
Accept-Ranges: bytes
X-NWS-LOG-UUID: 15004720177135051652
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2023/9/28/4399_14142542445.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2023/9/28/4399_14142542445.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 28 Sep 2023 06:14:25 GMT
Etag: "651519c1-1376"
Server: openresty
Date: Fri, 10 May 2024 09:52:19 GMT
Content-Type: image/jpeg
Expires: Sat, 10 May 2025 09:52:19 GMT
Cache-Control: max-age=31536000
Content-Length: 4982
Accept-Ranges: bytes
X-NWS-LOG-UUID: 566683194230701247
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2024/1/31/4399_13502049203.gif

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2024/1/31/4399_13502049203.gif HTTP/1.1
Accept: */*
Referer: http://www.4399.com/loadimg/iframe_action.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Wed, 31 Jan 2024 05:50:20 GMT
Etag: "65b9df9c-4a6b"
Server: openresty
Date: Sun, 11 Feb 2024 16:43:27 GMT
Content-Type: image/gif
Expires: Mon, 10 Feb 2025 16:43:27 GMT
Cache-Control: max-age=31536000
Content-Length: 19051
Accept-Ranges: bytes
X-NWS-LOG-UUID: 810085254486291820
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://imga5.5054399.com/upload_pic/2023/9/28/4399_13594328169.jpg

սɱ.exe

Remote address:

43.132.64.190:80

Request

GET /upload_pic/2023/9/28/4399_13594328169.jpg HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: imga5.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 28 Sep 2023 05:59:43 GMT
Etag: "6515164f-118d"
Server: openresty
Date: Mon, 22 Apr 2024 08:08:40 GMT
Content-Type: image/jpeg
Expires: Tue, 22 Apr 2025 08:08:40 GMT
Cache-Control: max-age=31536000
Content-Length: 4493
Accept-Ranges: bytes
X-NWS-LOG-UUID: 12957943962137423209
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://4399stat.5054399.com/js/click.js

սɱ.exe

Remote address:

174.35.118.62:80

Request

GET /js/click.js HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: 4399stat.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: application/javascript
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Last-Modified: Thu, 26 Nov 2020 03:21:42 GMT
ETag: W/"5fbf1f46-e36"
Expires: Wed, 09 Oct 2024 20:38:15 GMT
Cache-Control: max-age=1
Content-Encoding: gzip
X-Via: 1.1 PS-000-01sOz34:12 (Cdn Cache Server V2.0), 1.1 PSygldLON2ew56:20 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PS-LHR-01q9k95_47019-46748
GET

http://newsimg.5054399.com/images/comm/youxidzbq_20-20.png

սɱ.exe

Remote address:

138.113.149.152:80

Request

GET /images/comm/youxidzbq_20-20.png HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: newsimg.5054399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:14 GMT
Content-Type: image/png
Content-Length: 1539
Connection: keep-alive
Server: nginx
Last-Modified: Fri, 10 Aug 2018 06:17:37 GMT
ETag: "5b6d2e01-603"
Accept-Ranges: bytes
Age: 1
X-Via: 1.1 PSxgHK4jd171:9 (Cdn Cache Server V2.0), 1.1 PSelsmskMOW3vl102:11 (Cdn Cache Server V2.0), 1.1 PSygldLON4vx61:12 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b6_PSygldLON4nl64_33204-13042
GET

http://sbai.4399.com/4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm HTTP/1.1
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif, image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.ms-powerpoint, application/msword, */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: sbai.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 10 Nov 2022 09:45:58 GMT
Content-Encoding: gzip
Etag: "636cc856-7e1"
Server: openresty
Date: Sun, 18 Aug 2024 01:55:41 GMT
Content-Type: text/html
Content-Length: 1059
Accept-Ranges: bytes
X-NWS-LOG-UUID: 9821024358744860896
Connection: keep-alive
X-Cache-Lookup: Cache Hit
GET

http://sbai.4399.com/4399swf/js/chkDomain.js

սɱ.exe

Remote address:

43.132.64.188:80

Request

GET /4399swf/js/chkDomain.js HTTP/1.1
Accept: */*
Referer: http://sbai.4399.com/4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: sbai.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Last-Modified: Thu, 10 Nov 2022 09:56:09 GMT
Content-Encoding: gzip
Etag: "636ccab9-35b"
Server: openresty
Date: Tue, 23 Jul 2024 10:24:05 GMT
Content-Type: application/javascript
Expires: Wed, 23 Jul 2025 10:24:05 GMT
Cache-Control: max-age=31536000
Content-Length: 481
Accept-Ranges: bytes
X-NWS-LOG-UUID: 10632339112331216224
Connection: keep-alive
X-Cache-Lookup: Cache Hit
DNS

download.macromedia.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

download.macromedia.com

IN A

Response

download.macromedia.com

IN CNAME

download.macromedia.com.edgekey.net

download.macromedia.com.edgekey.net

IN CNAME

e13914.dscd.akamaiedge.net

e13914.dscd.akamaiedge.net

IN A

95.100.114.85
GET

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

սɱ.exe

Remote address:

95.100.114.85:80

Request

GET /pub/shockwave/cabs/flash/swflash.cab HTTP/1.1
Accept: application/x-cabinet-win32-x86, application/x-pe-win32-x86, application/octet-stream, application/x-setupscript, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: download.macromedia.com
Connection: Keep-Alive

Response

HTTP/1.1 302 Moved Temporarily

Server: AkamaiGHost
Content-Length: 0
Location: http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Date: Wed, 09 Oct 2024 20:38:15 GMT
Connection: keep-alive
DNS

fpdownload2.macromedia.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

fpdownload2.macromedia.com

IN A

Response

fpdownload2.macromedia.com

IN CNAME

fpdownload.macromedia.com.edgesuite.net

fpdownload.macromedia.com.edgesuite.net

IN CNAME

a1293.dspd.akamai.net

a1293.dspd.akamai.net

IN A

2.19.11.120

a1293.dspd.akamai.net

IN A

2.19.11.101
DNS

gprp.4399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

gprp.4399.com

IN A

Response

gprp.4399.com

IN CNAME

gprp.r.4399api.net

gprp.r.4399api.net

IN CNAME

gprp.4399.com.lxdns.com

gprp.4399.com.lxdns.com

IN A

174.35.118.62

gprp.4399.com.lxdns.com

IN A

138.113.101.14

gprp.4399.com.lxdns.com

IN A

163.171.129.134

gprp.4399.com.lxdns.com

IN A

174.35.118.63
GET

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

սɱ.exe

Remote address:

2.19.11.120:80

Request

GET /get/shockwave/cabs/flash/swflash.cab HTTP/1.1
Accept: application/x-cabinet-win32-x86, application/x-pe-win32-x86, application/octet-stream, application/x-setupscript, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: fpdownload2.macromedia.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Server: Apache
Last-Modified: Tue, 08 Dec 2020 11:38:06 GMT
ETag: "384e0-5b5f2605114af"
Accept-Ranges: bytes
Content-Length: 230624
Content-Type: application/vnd.ms-cab-compressed
Date: Wed, 09 Oct 2024 20:38:15 GMT
Connection: keep-alive
DNS

gprp.4399api.net

սɱ.exe

Remote address:

8.8.8.8:53

Request

gprp.4399api.net

IN A

Response

gprp.4399api.net

IN A

42.62.15.250

gprp.4399api.net

IN A

42.62.15.249
GET

http://gprp.4399.com/cg/recommend_api.php?from=index&page_size=27&page_num=1&simple=1&timestamp=1728506294453&callback=jQuery161003392294994604145_1728506293523&_=1728506294454

սɱ.exe

Remote address:

174.35.118.62:80

Request

GET /cg/recommend_api.php?from=index&page_size=27&page_num=1&simple=1&timestamp=1728506294453&callback=jQuery161003392294994604145_1728506293523&_=1728506294454 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: gprp.4399.com
Connection: Keep-Alive

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:15 GMT
Content-Type: application/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: openresty
apm_traceid: 79db45f6672a4f7cbd8760910358516b.324899.17285062956880333
Set-Cookie: _gprp_c=""; Domain=.4399.com; Expires=Mon, 27-Oct-2092 23:52:22 GMT; Path=/
Content-Encoding: gzip
X-Via: 1.1 PS-000-01sOz34:12 (Cdn Cache Server V2.0), 1.1 PSygldLON2hl59:8 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b7_PS-LHR-01q9k95_766-40614
DNS

get3.adobe.com

IEXPLORE.EXE

Remote address:

8.8.8.8:53

Request

get3.adobe.com

IN A

Response

get3.adobe.com

IN CNAME

get3.adobe.com.i.edgekey.net

get3.adobe.com.i.edgekey.net

IN CNAME

e29329.dsca.akamaiedge.net

e29329.dsca.akamaiedge.net

IN A

23.48.165.139

e29329.dsca.akamaiedge.net

IN A

23.48.165.146
DNS

hm.baidu.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

hm.baidu.com

IN A

Response

hm.baidu.com

IN CNAME

hm.e.shifen.com

hm.e.shifen.com

IN A

111.45.3.198

hm.e.shifen.com

IN A

14.215.183.79

hm.e.shifen.com

IN A

183.240.98.228

hm.e.shifen.com

IN A

14.215.182.140

hm.e.shifen.com

IN A

111.45.11.83
DNS

w.cnzz.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

w.cnzz.com

IN A

Response

w.cnzz.com

IN CNAME

c.cnzz.com

c.cnzz.com

IN CNAME

all.cnzz.com.danuoyi.tbcache.com

all.cnzz.com.danuoyi.tbcache.com

IN A

122.225.212.209
DNS

apps.4399.com

սɱ.exe

Remote address:

8.8.8.8:53

Request

apps.4399.com

IN A

Response

apps.4399.com

IN CNAME

apps.r.4399api.net

apps.r.4399api.net

IN CNAME

apps.4399.com.lxdns.com

apps.4399.com.lxdns.com

IN A

163.171.129.134

apps.4399.com.lxdns.com

IN A

174.35.118.62

apps.4399.com.lxdns.com

IN A

174.35.118.63

apps.4399.com.lxdns.com

IN A

138.113.101.14
GET

http://apps.4399.com/online/heartbeat?ptid=15&uid=0&gid=400&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506296663&callback=jQuery16107209898477910182_1728506296655&_=1728506296663

սɱ.exe

Remote address:

163.171.129.134:80

Request

GET /online/heartbeat?ptid=15&uid=0&gid=400&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506296663&callback=jQuery16107209898477910182_1728506296655&_=1728506296663 HTTP/1.1
Accept: */*
Referer: http://sbai.4399.com/4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: apps.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:18 GMT
Content-Type: text/html; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: openresty
Cache-Control: no-store
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
X-Via: 1.1 PS-XUZ-01eVR32:0 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:21 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9b9_PSygldLON2ew56_41464-48850
GET

http://apps.4399.com/online/heartbeat?ptid=15&uid=0&gid=123456&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506318184&callback=jQuery161003392294994604145_1728506293524&_=1728506318184

սɱ.exe

Remote address:

163.171.129.134:80

Request

GET /online/heartbeat?ptid=15&uid=0&gid=123456&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506318184&callback=jQuery161003392294994604145_1728506293524&_=1728506318184 HTTP/1.1
Accept: */*
Referer: http://www.4399.com/flash/123456_1.htm
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)
Host: apps.4399.com
Connection: Keep-Alive
Cookie: _4399stats_vid=17285062945198374; _gprp_c=""

Response

HTTP/1.1 200 OK

Date: Wed, 09 Oct 2024 20:38:39 GMT
Content-Type: text/html; charset=utf8
Transfer-Encoding: chunked
Connection: keep-alive
Server: openresty
Cache-Control: no-store
Access-Control-Allow-Origin: *
Access-Control-Allow-Methods: GET, POST, OPTIONS
Access-Control-Allow-Headers: DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization
Content-Encoding: gzip
X-Via: 1.1 PS-HKG-046K749:7 (Cdn Cache Server V2.0), 1.1 PSygldLON2kt55:21 (Cdn Cache Server V2.0)
x-ws-request-id: 6706e9cf_PSygldLON2ew56_41464-50354
DNS

crl.microsoft.com

Remote address:

8.8.8.8:53

Request

crl.microsoft.com

IN A

Response

crl.microsoft.com

IN CNAME

crl.www.ms.akadns.net

crl.www.ms.akadns.net

IN CNAME

a1363.dscg.akamai.net

a1363.dscg.akamai.net

IN A

2.19.117.18

a1363.dscg.akamai.net

IN A

2.19.117.22
GET

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

Remote address:

2.19.117.18:80

Request

GET /pki/crl/products/MicRooCerAut2011_2011_03_22.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Wed, 01 May 2024 09:28:59 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: crl.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1036
Content-Type: application/octet-stream
Content-MD5: 8M9bF5Tsp81z+cAg2quO8g==
Last-Modified: Thu, 26 Sep 2024 02:21:11 GMT
ETag: 0x8DCDDD1E3AF2C76
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
x-ms-request-id: b28c4ea1-d01e-0016-0ebc-0fa13d000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Wed, 09 Oct 2024 20:38:47 GMT
Connection: keep-alive
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

23.46.73.244
GET

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

Remote address:

23.46.73.244:80

Request

GET /pkiops/crl/MicCodSigPCA2011_2011-07-08.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
If-Modified-Since: Mon, 03 Jun 2024 21:25:24 GMT
User-Agent: Microsoft-CryptoAPI/6.1
Host: www.microsoft.com

Response

HTTP/1.1 200 OK

Content-Length: 1078
Content-Type: application/octet-stream
Content-MD5: cyz+t2uRxNE5eKALjGZu1w==
Last-Modified: Sun, 18 Aug 2024 00:23:49 GMT
ETag: 0x8DCBF1C07FCB4BF
x-ms-request-id: faca90a9-201e-0002-6d0b-f1e952000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Wed, 09 Oct 2024 20:38:47 GMT
Connection: keep-alive
TLS_version: UNKNOWN
ms-cv: CASMicrosoftCV1b3086b6.0
ms-cv-esi: CASMicrosoftCV1b3086b6.0
X-RTag: RT
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

23.46.73.244
DNS

www.microsoft.com

iexplore.exe

Remote address:

8.8.8.8:53

Request

www.microsoft.com

IN A

Response

www.microsoft.com

IN CNAME

www.microsoft.com-c-3.edgekey.net

www.microsoft.com-c-3.edgekey.net

IN CNAME

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net

IN CNAME

e13678.dscb.akamaiedge.net

e13678.dscb.akamaiedge.net

IN A

23.46.73.244

174.35.118.63:80

http://www.4399.com/images/Antiindulgence/ptlogin_mask.png

http

սɱ.exe

23.2kB
349.3kB
191
297

HTTP Request

GET http://www.4399.com/flash/123456_1.htm

HTTP Response

200

HTTP Request

GET http://www.4399.com/css/publicCssForPlay.css

HTTP Response

200

HTTP Request

GET http://www.4399.com/css/gameKeyForPlay.css

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/fl2016/logo.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/css/index3/color0.css

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/colour-1.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/sg.gif

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/jquery-1.6.1.min.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/f-scr2.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/fix2.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/icon-keyboard.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/mask-p.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/lazy_iframe_new.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/sosmart1_s.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/abclo2.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/js/globalSearchWord.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/newHeadjsForPlay_s.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/girlJsForPlay20220701.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/unilogin2.js?0102

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/hasPlayedForPlay.js?111

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/flashopen1.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/i2016/QR.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/allInOneAntiindulgencePC.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/antijs/Antiindulgence.js?20241092

HTTP Response

200

HTTP Request

GET http://www.4399.com/loadimg/noInstallFlashIE.html

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/blockflashtip_2022/browserIcon-360-big.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/jquery-11.2.min.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/age/newBgAll.jpg

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/age/ageLimit-tip.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/age/123456.js?_=1728506298872

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/age/16.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/Antiindulgence/ptlogin_mask.png

HTTP Response

200
174.35.118.63:80

http://www.4399.com/images/age/ageLimit-logo.png

http

սɱ.exe

20.0kB
158.9kB
107
155

HTTP Request

GET http://www.4399.com/css/commonCssForPlay20230424.css

HTTP Response

200

HTTP Request

GET http://www.4399.com/js/serversbai.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/fix.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/loadimg/loading.htm

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/fix2.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/mask.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/more_ico.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/playcoup.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/skiner27.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/xndbg.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/lazyloading.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/antijs/age.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/p2016/p-bg.jpg

HTTP Response

200

HTTP Request

GET http://www.4399.com/js/4399stat.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/loadimg/iframe_action.htm

HTTP Response

200

HTTP Request

GET http://www.4399.com/loadimg/noInstallFlashIE.html

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/css/blockflashtip_20240423.css

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/flashdist.js

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/blockflashtip_2022/iconTips.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/new/close.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/jss/unilogin_package.js?1018

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/blockflashtip_2022/iconFlash.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/blockflashtip_2022/browserIcon-qq-big.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/httpsNot301/blockflashtip_2022/browserIcon-sg-big.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/loadimg/age.htm?id=123456

HTTP Response

200

HTTP Request

GET http://www.4399.com/css/age.css

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/age/diaClose.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/age/ageLimit-tit.png

HTTP Response

200

HTTP Request

GET http://www.4399.com/images/age/ageLimit-logo.png

HTTP Response

200
163.171.128.161:80

http://ptlogin.3304399.net/resource/ucenter.js?20241092

http

սɱ.exe

1.7kB
32.9kB
19
29

HTTP Request

GET http://ptlogin.3304399.net/resource/css/base.css?20241092

HTTP Response

200

HTTP Request

GET http://ptlogin.3304399.net/resource/ucenter.js?20241092

HTTP Response

200
43.132.64.188:80

http://imga2.5054399.com/upload_pic/2024/9/26/4399_16342426278.jpg

http

սɱ.exe

6.8kB
75.7kB
55
82

HTTP Request

GET http://imga2.5054399.com/upload_pic/7272/4/37151.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2012/6/11/4399_15041743040.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2013/8/30/4399_17073799381.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2020/9/16/4399_17074684634.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2024/7/12/4399_15382598886.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2022/6/22/4399_14163082518.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/minilogo/123456.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2023/9/28/4399_10461843815.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2024/9/26/4399_16342426278.jpg

HTTP Response

200
43.132.64.188:80

http://imga2.5054399.com/upload_pic/2024/3/1/4399_17225675210.jpg

http

սɱ.exe

3.7kB
33.0kB
33
44

HTTP Request

GET http://imga2.5054399.com/upload_pic/2024/7/5/4399_12374219801.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/7272/5/40921.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2013/9/28/4399_13520493927.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2024/9/9/4399_16551217162.jpg

HTTP Response

200

HTTP Request

GET http://imga2.5054399.com/upload_pic/2024/3/1/4399_17225675210.jpg

HTTP Response

200
43.132.64.188:80

http://imga1.5054399.com/upload_pic/2021/11/17/4399_09480196660.jpg

http

սɱ.exe

6.5kB
51.6kB
47
67

HTTP Request

GET http://imga1.5054399.com/upload_pic/2016/4/18/4399_10515806953.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/7272/8/77745.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2013/6/6/4399_15495613950.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/7272/7/66920.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2023/9/28/4399_11400644897.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2014/7/26/4399_16192154669.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2019/8/8/4399_11000180171.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2024/1/17/4399_15185234953.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2021/11/17/4399_09480196660.jpg

HTTP Response

200
43.132.64.188:80

http://imga1.5054399.com/upload_pic/2024/9/27/4399_18054269006.jpg

http

սɱ.exe

5.9kB
49.6kB
43
61

HTTP Request

GET http://imga1.5054399.com/upload_pic/2013/1/15/4399_16090213522.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/7272/4/38230.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2013/9/16/4399_16325143503.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2012/10/18/4399_11100951416.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2021/1/12/4399_11293298167.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2024/9/11/4399_16110796047.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2023/11/22/4399_10381421104.jpg

HTTP Response

200

HTTP Request

GET http://imga1.5054399.com/upload_pic/2024/9/27/4399_18054269006.jpg

HTTP Response

200
43.132.64.190:80

http://imga4.5054399.com/upload_pic/2024/8/13/4399_14394822761.jpg

http

սɱ.exe

3.0kB
26.1kB
27
36

HTTP Request

GET http://imga4.5054399.com/upload_pic/2016/2/29/4399_16202750741.jpg

HTTP Response

200

HTTP Request

GET http://imga4.5054399.com/upload_pic/2014/3/6/4399_17214233822.jpg

HTTP Response

200

HTTP Request

GET http://imga4.5054399.com/upload_pic/7272/2/11938.jpg

HTTP Response

200

HTTP Request

GET http://imga4.5054399.com/upload_pic/2024/8/13/4399_14394822761.jpg

HTTP Response

200
43.132.64.188:80

http://imga3.5054399.com/upload_pic/2021/2/3/4399_15125506077.jpg

http

սɱ.exe

5.4kB
47.2kB
43
63

HTTP Request

GET http://imga3.5054399.com/upload_pic/2020/9/18/4399_15004677609.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2013/1/18/4399_19133429371.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2013/11/14/4399_11454656379.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2016/2/19/4399_15264030803.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/7272/9/1232.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2024/9/11/4399_17044958903.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2021/10/12/4399_19114079011.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2021/2/3/4399_15125506077.jpg

HTTP Response

200
43.132.64.188:80

http://imga3.5054399.com/upload_pic/2016/2/18/4399_18432063237.jpg

http

սɱ.exe

4.5kB
37.5kB
33
50

HTTP Request

GET http://imga3.5054399.com/upload_pic/2013/3/18/4399_09532349388.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2024/7/10/4399_14565164570.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2021/2/8/4399_14260278402.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2013/5/16/4399_11483168018.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2023/9/28/4399_14134793184.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2024/9/4/4399_15574975968.jpg

HTTP Response

200

HTTP Request

GET http://imga3.5054399.com/upload_pic/2016/2/18/4399_18432063237.jpg

HTTP Response

200
43.132.64.190:80

http://imga4.5054399.com/upload_pic/2022/10/20/4399_16333396421.jpg

http

սɱ.exe

2.6kB
22.6kB
20
31

HTTP Request

GET http://imga4.5054399.com/upload_pic/7272/1/7523.jpg

HTTP Response

200

HTTP Request

GET http://imga4.5054399.com/upload_pic/2013/9/13/4399_16440175488.jpg

HTTP Response

200

HTTP Request

GET http://imga4.5054399.com/upload_pic/2023/9/28/4399_14144905869.jpg

HTTP Response

200

HTTP Request

GET http://imga4.5054399.com/upload_pic/2022/10/20/4399_16333396421.jpg

HTTP Response

200
43.132.64.188:80

http://imga.5054399.com/upload_pic/2023/12/5/4399_13553984400.jpg

http

սɱ.exe

4.4kB
88.8kB
49
81

HTTP Request

GET http://imga.5054399.com/upload_pic/2013/5/7/4399_14253243523.jpg

HTTP Response

200

HTTP Request

GET http://imga.5054399.com/upload_pic/2024/10/9/4399_09215957460.gif

HTTP Response

200

HTTP Request

GET http://imga.5054399.com/upload_pic/2024/6/11/4399_14375730684.jpg

HTTP Response

200

HTTP Request

GET http://imga.5054399.com/upload_pic/2023/12/5/4399_13553984400.jpg

HTTP Response

200
174.35.118.63:80

http://s4.img4399.com/cg/resource/js/api/gprp.js?2013

http

սɱ.exe

1.9kB
14.9kB
14
16

HTTP Request

GET http://s4.img4399.com/cg/resource/js/api/gprp.js?2013

HTTP Response

200
43.132.64.190:80

http://imga5.5054399.com/upload_pic/2016/2/17/4399_16081405239.jpg

http

սɱ.exe

7.3kB
70.3kB
56
84

HTTP Request

GET http://imga5.5054399.com/upload_pic/2019/8/23/4399_11432738662.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2012/4/21/4399_15161199933.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2013/11/20/4399_14214382641.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2016/2/23/4399_20255017634.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2016/2/23/4399_19500754537.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2024/9/20/4399_15320883287.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2023/11/1/4399_10260731958.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2024/1/16/4399_13522128559.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2023/4/7/4399_15413094698.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2020/5/20/4399_09324294709.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2016/2/17/4399_16081405239.jpg

HTTP Response

200
43.132.64.190:80

http://imga5.5054399.com/upload_pic/2023/9/28/4399_13594328169.jpg

http

սɱ.exe

6.7kB
69.3kB
53
78

HTTP Request

GET http://imga5.5054399.com/upload_pic/2014/4/14/4399_16123010721.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/7272/5/41119.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2012/9/10/4399_14455835923.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2016/2/19/4399_15071153648.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2024/1/17/4399_10264901544.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2024/9/20/4399_11513472760.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2024/3/12/4399_09120577908.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2023/9/28/4399_14142542445.jpg

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2024/1/31/4399_13502049203.gif

HTTP Response

200

HTTP Request

GET http://imga5.5054399.com/upload_pic/2023/9/28/4399_13594328169.jpg

HTTP Response

200
43.132.64.188:80

sbai.4399.com

սɱ.exe

52 B
1
174.35.118.62:80

http://4399stat.5054399.com/js/click.js

http

սɱ.exe

731 B
2.2kB
7
8

HTTP Request

GET http://4399stat.5054399.com/js/click.js

HTTP Response

200
138.113.149.152:80

http://newsimg.5054399.com/images/comm/youxidzbq_20-20.png

http

սɱ.exe

698 B
2.2kB
6
6

HTTP Request

GET http://newsimg.5054399.com/images/comm/youxidzbq_20-20.png

HTTP Response

200
43.132.64.188:80

http://sbai.4399.com/4399swf/js/chkDomain.js

http

սɱ.exe

1.6kB
2.7kB
10
11

HTTP Request

GET http://sbai.4399.com/4399swf/upload_swf/ftp12/chenweihong/20130928/xyzj/fcmv1032s.htm

HTTP Response

200

HTTP Request

GET http://sbai.4399.com/4399swf/js/chkDomain.js

HTTP Response

200
95.100.114.85:80

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

http

սɱ.exe

824 B
646 B
7
5

HTTP Request

GET http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

HTTP Response

302
2.19.11.120:80

http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

http

սɱ.exe

4.7kB
237.9kB
91
175

HTTP Request

GET http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

HTTP Response

200
174.35.118.62:80

http://gprp.4399.com/cg/recommend_api.php?from=index&page_size=27&page_num=1&simple=1&timestamp=1728506294453&callback=jQuery161003392294994604145_1728506293523&_=1728506294454

http

սɱ.exe

862 B
3.4kB
7
8

HTTP Request

GET http://gprp.4399.com/cg/recommend_api.php?from=index&page_size=27&page_num=1&simple=1&timestamp=1728506294453&callback=jQuery161003392294994604145_1728506293523&_=1728506294454

HTTP Response

200
42.62.15.250:80

gprp.4399api.net

սɱ.exe

152 B
3
23.48.165.139:443

get3.adobe.com

tls

IEXPLORE.EXE

751 B
4.3kB
10
9
23.48.165.139:443

get3.adobe.com

tls

IEXPLORE.EXE

751 B
4.4kB
10
11
163.171.129.134:80

http://apps.4399.com/online/heartbeat?ptid=15&uid=0&gid=123456&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506318184&callback=jQuery161003392294994604145_1728506293524&_=1728506318184

http

սɱ.exe

1.8kB
3.4kB
10
13

HTTP Request

GET http://apps.4399.com/online/heartbeat?ptid=15&uid=0&gid=400&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506296663&callback=jQuery16107209898477910182_1728506296655&_=1728506296663

HTTP Response

200

HTTP Request

GET http://apps.4399.com/online/heartbeat?ptid=15&uid=0&gid=123456&token=&result_encode=urlencode&is_adult=&verify_status=&refresh=0&not_login=0&timestamp=1728506318184&callback=jQuery161003392294994604145_1728506293524&_=1728506318184

HTTP Response

200
111.45.3.198:80

hm.baidu.com

սɱ.exe

152 B
3
122.225.212.209:80

w.cnzz.com

սɱ.exe

152 B
3
23.48.165.139:443

get3.adobe.com

tls

IEXPLORE.EXE

783 B
4.3kB
10
9
42.62.15.249:80

gprp.4399api.net

սɱ.exe

152 B
3
111.45.3.198:443

hm.baidu.com

սɱ.exe

152 B
3
14.215.183.79:80

hm.baidu.com

սɱ.exe

152 B
3
2.19.117.18:80

http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

http

399 B
1.7kB
4
4

HTTP Request

GET http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl

HTTP Response

200
23.46.73.244:80

http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

http

393 B
1.7kB
4
4

HTTP Request

GET http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl

HTTP Response

200
183.240.98.228:443

hm.baidu.com

սɱ.exe

152 B
3
183.240.98.228:80

hm.baidu.com

սɱ.exe

152 B
3
14.215.182.140:443

hm.baidu.com

սɱ.exe

152 B
3
14.215.182.140:80

hm.baidu.com

սɱ.exe

152 B
3
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

747 B
7.8kB
9
12
204.79.197.200:443

ieonline.microsoft.com

tls

iexplore.exe

779 B
7.8kB
9
12
111.45.11.83:80

hm.baidu.com

սɱ.exe

152 B
3
111.45.11.83:443

hm.baidu.com

սɱ.exe

152 B
3
111.45.3.198:443

hm.baidu.com

սɱ.exe

152 B
3

8.8.8.8:53

www.4399.com

dns

սɱ.exe

58 B
155 B
1
1

DNS Request

www.4399.com

DNS Response

174.35.118.63

163.171.130.132

174.35.118.62

163.171.129.134
8.8.8.8:53

imga3.5054399.com

dns

սɱ.exe

63 B
234 B
1
1

DNS Request

imga3.5054399.com

DNS Response

43.132.64.188

43.132.64.190
8.8.8.8:53

imga.5054399.com

dns

սɱ.exe

62 B
232 B
1
1

DNS Request

imga.5054399.com

DNS Response

43.132.64.188

43.132.64.190
8.8.8.8:53

imga4.5054399.com

dns

սɱ.exe

63 B
234 B
1
1

DNS Request

imga4.5054399.com

DNS Response

43.132.64.190

43.132.64.188
8.8.8.8:53

imga1.5054399.com

dns

սɱ.exe

63 B
234 B
1
1

DNS Request

imga1.5054399.com

DNS Response

43.132.64.188

43.132.64.190
8.8.8.8:53

imga2.5054399.com

dns

սɱ.exe

63 B
234 B
1
1

DNS Request

imga2.5054399.com

DNS Response

43.132.64.188

43.132.64.190
8.8.8.8:53

imga5.5054399.com

dns

սɱ.exe

63 B
234 B
1
1

DNS Request

imga5.5054399.com

DNS Response

43.132.64.190

43.132.64.188
8.8.8.8:53

ptlogin.3304399.net

dns

սɱ.exe

65 B
140 B
1
1

DNS Request

ptlogin.3304399.net

DNS Response

163.171.128.161

163.171.146.64
8.8.8.8:53

sbai.4399.com

dns

սɱ.exe

59 B
234 B
1
1

DNS Request

sbai.4399.com

DNS Response

43.132.64.188

43.132.64.190
8.8.8.8:53

newsimg.5054399.com

dns

սɱ.exe

65 B
203 B
1
1

DNS Request

newsimg.5054399.com

DNS Response

138.113.149.152

163.171.129.134

174.35.118.62

174.35.118.63
8.8.8.8:53

4399stat.5054399.com

dns

սɱ.exe

66 B
171 B
1
1

DNS Request

4399stat.5054399.com

DNS Response

174.35.118.62

163.171.129.134

174.35.118.63

163.171.146.42
8.8.8.8:53

s4.img4399.com

dns

սɱ.exe

60 B
159 B
1
1

DNS Request

s4.img4399.com

DNS Response

174.35.118.63

163.171.146.42

163.171.129.134

174.35.118.62
8.8.8.8:53

download.macromedia.com

dns

սɱ.exe

69 B
171 B
1
1

DNS Request

download.macromedia.com

DNS Response

95.100.114.85
8.8.8.8:53

fpdownload2.macromedia.com

dns

սɱ.exe

72 B
189 B
1
1

DNS Request

fpdownload2.macromedia.com

DNS Response

2.19.11.120

2.19.11.101
8.8.8.8:53

gprp.4399.com

dns

սɱ.exe

59 B
189 B
1
1

DNS Request

gprp.4399.com

DNS Response

174.35.118.62

138.113.101.14

163.171.129.134

174.35.118.63
8.8.8.8:53

gprp.4399api.net

dns

սɱ.exe

62 B
94 B
1
1

DNS Request

gprp.4399api.net

DNS Response

42.62.15.250

42.62.15.249
8.8.8.8:53

get3.adobe.com

dns

IEXPLORE.EXE

60 B
171 B
1
1

DNS Request

get3.adobe.com

DNS Response

23.48.165.139

23.48.165.146
8.8.8.8:53

hm.baidu.com

dns

սɱ.exe

58 B
164 B
1
1

DNS Request

hm.baidu.com

DNS Response

111.45.3.198

14.215.183.79

183.240.98.228

14.215.182.140

111.45.11.83
8.8.8.8:53

w.cnzz.com

dns

սɱ.exe

56 B
131 B
1
1

DNS Request

w.cnzz.com

DNS Response

122.225.212.209
8.8.8.8:53

apps.4399.com

dns

սɱ.exe

59 B
189 B
1
1

DNS Request

apps.4399.com

DNS Response

163.171.129.134

174.35.118.62

174.35.118.63

138.113.101.14
8.8.8.8:53

crl.microsoft.com

dns

63 B
162 B
1
1

DNS Request

crl.microsoft.com

DNS Response

2.19.117.18

2.19.117.22
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

23.46.73.244
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

23.46.73.244
8.8.8.8:53

www.microsoft.com

dns

iexplore.exe

63 B
230 B
1
1

DNS Request

www.microsoft.com

DNS Response

23.46.73.244

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
a266bb7dcc38a562631361bbf61dd11b

SHA1
3b1efd3a66ea28b16697394703a72ca340a05bd5

SHA256
df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

SHA512
0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
252B

MD5
c6c9126dc967d1b1d1354f7c2125d194

SHA1
d3a1cb40fe366bf4db8f25ff892519f95c34d65d

SHA256
be8f990b2749cb8d32e9ea22aa2399891fcdb3ceab728618aeb8b5c302b3fdbb

SHA512
e329dfe2b7fea27ee78f079fd1dc2c2bc8a277f8e24265ac0fd1fad4ad5423d0cf58037b29768f1d1982ab7ff9900ad43fc8454916e27f12c4b9a4028cbbb32f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
9d842e1d4f1c7407face53e96989fd2b

SHA1
e13c057315757ff86e5c7ee7db4f07bdc053ce29

SHA256
052c9b82a5d4335b3d3edca7acf8779be0ce5df7f70fa8858d3a37cc5e576839

SHA512
2306e26486cb45662db56a53f50f2f31f5d036eb4f6dffa19f0e977cd5a006e422c12bb65791a50e00f3ada13ee6f5d46554d2142c0c71f5f6a2ab941e80ca5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d4487ae48e294796381e1c889a2b840c

SHA1
43539cd0ed7d48f48f9cfd33ae742765815c59b7

SHA256
dab703543fc0e56739bbcda3163b79f09dfa4457adca295ddc30a558bab1fa3a

SHA512
71e9ab3503fc1d46f6c127302107102abe3f22ba35a6a430f3d182cc1320a455703e31ef7202619282257ec8ec0608e0ff9ceff40ee9fe6140dc9e6e0d59a4a3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cb84863a2e9720211352e29026abbb80

SHA1
9d516ea83c77296fb1869745602d5b3d9ccb565f

SHA256
f4e13cafd707d5b06155b122959e821781596e64648c3302b5759a5dd177fdff

SHA512
87ead5f03f8f74f1cc297a61a40f4f54351918fe4b5416026f5d2fdcac835d8583edd74a3e29ddd4685d06e760c243d760d3ca16ac244f2780afb74a5b976d56

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3eb606bc838538715d7ec50fbe7976be

SHA1
becafbba91d6ce99a0cbd773d3af550f7766a9c9

SHA256
ba456784dac5167441da3067747d94d298fd9d09540021e21ffaa9960cdcb727

SHA512
6815a58ccc23c155a98c1e763305b2b0bfa8bff654029a7a66ac7be5770a459fe78f809bb909db90f255a4c6d6ecc5bf5267d7ec5a9335af05a2fbdde46ae1b0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7e578f75b9a18e4aa9d08361dede52e7

SHA1
b5ae79413a478d30d6ce3f72e5c7a417080c1ead

SHA256
c46f10cce5c67bc17e5d49100450ba273d5d167e9d9831321dc153e605ad7c3f

SHA512
152721dccd8b9e1e9a0e1b464d8ac7e8ad2ff1cbdf364f0734d4b30913fa46c77577b61570295c100ba24d8b897dd8dde61fa186746a1d6ef5f70c9470895c5f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
f7419bf6f3432991d93e3fb873b334da

SHA1
3682ef02ad677a936e05a796fc9739d0b1be213b

SHA256
1aee715d80f374a8ebbf992d2472c3e68a134bef9b61991aa13a54c6053ee491

SHA512
e4dc09a79229267b67123c099e922a5f204296f6c47595195225b86ca86bc9390e931523faf2c284ea00a35a14f2292a03b894b07072d3d5ee46de96bcd3c943

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a8689441659f22e5a0aa8a4fa7f8225

SHA1
f52d7961a5261e6c494ec433e91302688e3bc81a

SHA256
b82cdd653c75d7f3f71757ba78c076f68aee24a6021cba972df9ccf460acc01b

SHA512
7a818acb02275d7653972a3cf7e709b6d96922de68e9d1eb259e954353ceb85835548e36f06265a1d8cf9e23c195a0eefbc64b89beb9a1f566f4dc425f0742a6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
49767f02877736c6388ee47000d45295

SHA1
b9ed350bb5c87f9e15ab387c92c60bca420a550f

SHA256
4cdcd3593df9aa3524db66246eb7d69ccc66cc7f2cb0c1df370ef98e27d95c60

SHA512
38abf7afcef8710353c624f6fcda73a10d659bdf4fc66de913df8686afbd8e3d1c2f5992e50d06ae989850a25ce8deb66f9397dd1c9c4bc69ddfd55556f70c02

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2888b80caf38b6b3bc597f8f68b6b13b

SHA1
f625a63f6b4f95ac1e253916db0556dc6ba0f528

SHA256
34b494c60f6f35f213f9055404a8e87bb852366c5fa46a9ce44d617a82369bd5

SHA512
d7d8ee487c14b3454b5157bf1f73147875114b28c938d4129be7fe9a8fcadd2e95258711e9ede5ceaccc0ac9f72c3263d4736256c41e69c8a3d4a46c86f74fc4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7eca14cc15bdbe0e4fe93c4b4c044673

SHA1
e27ce4e4a98e8879b19a9ccf353822f1c16ad7d9

SHA256
74f8fedb7bc154b8952a84daed6ef45a5a5a546709e80c3a0230aa5142310034

SHA512
130b56e3ba40b93ffed04be0843bfae39fc41815a1c964fddf7252c447da7b4f1294cde5a9b5178c9928f4f9de410405b50971c4d4216365ae667619bbc227fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
6ad516f7bdb7070b3ae010cce682c164

SHA1
77c1807ea26b0c122f63561c4b21d2ddd6f85545

SHA256
32ce1db8c3904f2033a8356263fdd49bc45ade9dea3e644d3676580ddbacf667

SHA512
feebb09256cbcb23e02afd20adb900071966e8d5c4a4908bc317e4b224fa2a3cb8d1abd21e95972456097af9af8b9ce446661086ce10a5b14be9d5d3a09490bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
03bacce118d889670081a93a485977c7

SHA1
8c30d992dadc48f5b2baa3c7a2777b496f2fe91d

SHA256
07cf9eb2fad321407f70c0450553bec8fc675a8da4e3b5e90b7e01b04844e9ff

SHA512
b8e86992ddc588946e30b65d6ff0e04a3f8597fed1e0b83ca40a985c8a2b02e689c09741facfe2ff09cddebd893849aabaaeb1d83d25317000f201104fe8310e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
cacd5a85ed1706db7f23ba5c24d91a85

SHA1
83e5c7bfa3b7734ae9badd870487d71cbfa76704

SHA256
ab31d180c4dff8c79d7750cc51962f3f6297277d8c91ca7862ab4a2d25639ca6

SHA512
f39160bef9f096b6f1ecb34c2c7e8a8d642b3468282760b9c260cc4ce3b781d80211c57ae2eeaa3ebbf1ba02d5bfef42211b435bc4026f8ccd85688960b62ded

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4b5e836939c50b359baec37dc8c399da

SHA1
ba18676a51050a4f4587dfe9dd8a83e41606e819

SHA256
26d2ef0f82e872140ffbb8b95e6e05fa015907f2e0f5dc747244e14f202b8835

SHA512
78105ffaa74e76cae2e8db17dc22a1c816f281d01639592ac747a326550a9968006217fd998ddfb2a7db8c315ad536f60550432711a7fe3014946a8ece18fe9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a19b92b38274fd29dbe555e1f7c2f956

SHA1
deb58a069b40c3563147d84847de7f9ae5fdd868

SHA256
b943f8e5331fc7586c8fc64ad2cde6069ed30de5d28652ad38a1e5efb42fac0f

SHA512
4bfe93c445f1d659de9a06ba182b016c1073fd2085f9bb7ebf618dee53c1065a96e3e8d4b7911c18e5735f8319231bbff81608884ebcb2a874739ff1ab731686

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
3c53c1738eb046edf105830525e72457

SHA1
8da8a9989bfca37e88adda16cb010e0192e87800

SHA256
3e0c239d809241ea567393c6c1075830a736d1a7c6a42ae890ccae91d5912d3a

SHA512
cb89c76b077e3d1ae4820b8391d8b8208da8b960839964f7ec2dad17e273abcccabb58b821cb7a4ca496057ad2f4c24acb7c619d9f684e42b858ab663d95b5ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
2a056abbe013c1e2af91622da9b3d792

SHA1
bda10e4b37d0fcef594c6eb02708b8b4a2b762ea

SHA256
476caed55665e87a43a7a4476183ad80b7cd16834d2d093a7ba109f5a861b3aa

SHA512
5d34bb6aef9412994201dc205ac1064af2972628ab5befa5dab813fa834af4e0928fef8dfbe7ce15f093b4cade0f4c6040eee288c7767379b59c378c946ff92c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
358a1d7c340f6c0db0356e92feb693d1

SHA1
db9e4937892dc5b9daf47629a569383271adf234

SHA256
426d7b42ea71aca283adfdfe2f0aa3aa1c1e7b630bd4b7bc4c8509524ba3be8e

SHA512
41c38180c64cde90529ebe84443d796d26308155976462d6334529beb0883fb007388933f6b0c8193323257a2daed76f3601219daa637dfce4dcee474267e00b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
606e2fc2ae15aa3ce6b1fe5c0e5d988f

SHA1
33007933358f9690034c1b5a1d46cbec6d68c2e3

SHA256
9d54a3f0aba04178bff5b0ffe0696abfb5c1dd3ff048b03d08845461560f74a9

SHA512
a45a57943bca5340f63e69ff46c09f8f41f24c3953abfdd3c42cd663d5d08f9c400b909f142ade5970d5443f87ccb67579c4a039a6551fb0ad2c5e35614512fd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
486f42276c6a4814e5f28c1efe086802

SHA1
d709c4c006634ac188284b1d4e8681ce1fdf3340

SHA256
99cb28afa02226986b6e5426b46389e32e65b90b8f4497cfb70e6b540f94e20f

SHA512
665b68a1ceeabb1b88fe996e80cda94a3b4898cc3182e6d1932a4031104c666afe166ed4d00bab6d288325d63bca45b0d2b808e30bb4c636a6a0decb98fe88f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
153c40b8fae91ad3115fcbd8e66612d7

SHA1
dbb7f9c4116096f2ad04a7d5f06bd0424214c276

SHA256
f79aeded9d64ae6a349670de26503322e36401dbd4a216effc547943e8624265

SHA512
c5d8a5bb5ba6b4086406d68c2fdb1b7a1ad8d2caf9486e92d8a195816c12d163d14492803472089dc958c735433f0c66f340ac08d2c8010f1c5a6c3ddaa0f2e5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e45072b2eee96a1add34f0079e20f0bd

SHA1
04d408a1d2ee3b88e0aa0ba4f69abf8db21c26fe

SHA256
4ede63c506e75b52e6ad19b4b7ba48b9a8d3d5a42d47a31f66cfd3e689755781

SHA512
0c598a3aacb4e938478c0fd361fa200bc7e4ce2f5a8156279715c8d4959e3ee9ed5e703a4ab09509aeff9e009cbddd5cbd418ea79eac1f8c11a48c0a86de3b20

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
94761b54c6ba0cab689774c7a9467a1b

SHA1
1da22dbe889cc3a76e56cb58902aec385d57b2a9

SHA256
14ad46181f168c290ac71e14b0ada09b10892b1e65f941358611c3e3f0d10332

SHA512
41a2a2781bd35f7131facca66ef0f37f4fef99635b989f6102b8fdef86003e692f33a371c3a3253c6976efad317a896e1bd0ce53ca2124a0642acf61c5641350

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
ca35f6a09bb4470be282bf7dec57f1ff

SHA1
61fb2c6e3790b01bb3ae06ea11e2afd620155823

SHA256
f6eabe1898fd351815a1b9be36cbf1d555ed44f0731937756862f77f07aa2584

SHA512
81f5c902bd31606a346a958fbc28547959316e5b8e4378866ea87076ac5209adeba5e87bb8511b33cbae26c1d2ecf16f1c52d3abf71e20280914e754bfcb71ad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
d3cd0bfb6f219e3f159c47cc156a0b61

SHA1
bdac86bd6185225f0fea8a8b667f8ae406b3327f

SHA256
529a1f9e1ee79d11d58f9ba4501bccd2653ffa1fbf8f486d768961efa3ba0395

SHA512
f5af843861961425186a4aac1ac3fd7857cb69c4ff7bd259d12dcb9f595194c893f2d24845f1d9979d0686028832d9a209ca7fca9162e01beb60d622e369f67e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
fc729904736810b1575e566aa54691ea

SHA1
46a9e0597a43cca4b92036d971247dc17c312339

SHA256
50b002c38d447e60096bfb02de29ed225c332343bc58b92599adc5657ae5a52c

SHA512
23d05b60709c974f76eaaa1a1682254d424d0dde8295add60bef6ebc2f72013cf1c16963ce0bc07950389486799c404cddc29b7414191d28ab8b75a0ad4e7ba2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
0e0ad53c8420c1e9b211fae158b0d1de

SHA1
615f3c9674455964271beb4465c7b6afd62d4a86

SHA256
46132c5e8a27f9206630c4c60f97f235c7208b6c42d3817cfc7286f7ce2c993c

SHA512
000837f03af6626312543ffb125813a8617c1d00032674bff8d4f98651998d997910a962a169942013f1bd4151bbfa02f9fc83e218f71c6e5f5ca438d7375116

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
55579e18bc8157178c333d3c9fb400d3

SHA1
f40c3cdb3f371f025018611c3008f8c9aa428803

SHA256
6f8727916b64f76fc3b8eab09afbfeb4fd903bf2a7994b33fc09ccfd7a434785

SHA512
b6f1776451ececfd285dc84be2c837116eabd04f267bb214a0a46a434490af52c9b2a0c5551bf7c0600aa19778aadabca623112cf776eb788081ce5e19140dd5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
266b573dc99848b5f39550d74796b53d

SHA1
a48731bcd1487f4679d60a0195a294dbadac42f0

SHA256
a4a191fa2441faa6d03a71a4142f37f1c07362da7ea0dbc4874cd9badb4cbdba

SHA512
b320f868758397646bc4a288f1be4bb11de333c233a3ad91821586bce662589b8e9c01d2326e42669f905f197b759d6e7cb5049185bb9cf3b46fb5a0cf269fad

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
d1b39d478a0781bb10725ddc8a233297

SHA1
5bcd184da39ec76b714c0555a2f2d53ca87c32f9

SHA256
1885764ed150b3925e236e1da0f86bef52109bc7179089c88a9d26c620562ffe

SHA512
486588d51b4c17438908a5d9d5c7f6a13cb7e4cad84eb6b7eae19269df9070b2d2eea6161fbe3d24398486b6483e197cc6e452132fa4e8ac1f4a50f42d5aa3f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\Antiindulgence[1].js

Filesize
32KB

MD5
c6f09ffcd8a6c80915d0311ebf2d3e58

SHA1
5e301d521787dd0e667b3533fdd18426039327ca

SHA256
20b4e53e948de804a416cfe1ed050f51f0c4b74d89d080080ce160ba0eb3bb91

SHA512
a6f2490dc25f81c95ac2da62181013cc302a046b03f9919e399e4c44bf6f7cbeee1a0b81955bf7cbf401b8f269b4688bd6b405ea2d29a045d8986d3c83a824fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\blockflashtip_20240423[1].css

Filesize
3KB

MD5
bb090a20f146f31169be9ffdb80fea69

SHA1
cd44b07355f6ec73c248c87aed90eff124cd6995

SHA256
803c65223be5d9ae838dd5b47cd5d68fefadf09c272cc0c25f5630a51208b483

SHA512
8575d9cd47c3880c7c0c7474168df7bea6728cb9d36bc07c7a4e087daa9b8ee2405e4fd0d8ac925321756695baf751e3be9d0ac34e881a203087407f4e7dbffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\jquery-1.6.1.min[1].js

Filesize
89KB

MD5
a34f78c3aecd182144818eb4b7303fda

SHA1
6fca78dac2797c02d86a4bf6514eda398b7dbe62

SHA256
c784376960f3163dc760bc019e72e5fed78203745a5510c69992a39d1d8fe776

SHA512
ddec07100503fdad6655d4e90aaac246719e9667611b35b112e4694e2671b43f4c4ef0b87371d3a6e173f7ade9dfd2058e5e165a41c3a250007d49ec18f2419c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\swflash[1].cab

Filesize
225KB

MD5
b3e138191eeca0adcc05cb90bb4c76ff

SHA1
2d83b50b5992540e2150dfcaddd10f7c67633d2c

SHA256
eea074db3f86fed73a36d9e6c734af8080a4d2364e817eecd5cb37cb9ec9dc0b

SHA512
82b4c76201697d7d25f2e4f454aa0dd8d548cdfd3ebfa0dd91845536f74f470e57d66a73750c56409510d787ee2483839f799fef5d5a77972cd4435a157a21a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\0E1IWGZ4\ucenter[1].js

Filesize
99KB

MD5
883b332034a6d10d8e7bb63f019228bc

SHA1
6c514df2f25bbdb6642540188e73682bdf663a9d

SHA256
fddfa6bc2183bb1c3efaf0e9a9bf111b8b13ddedd515fc11c699fd5904d64e8e

SHA512
813a5d752b0b0299be5150b824cab3f1ccf6f4e8b47d6842168e9dd53e20759744729c4802359f6f215ded72599994466b6419524dfc8cc84e726c5fb49ebe25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\6XUZ2JLF\base[1].css

Filesize
61KB

MD5
880e44448d953808d8c78939831639f2

SHA1
85449723d7920bcd49d16ec45f1c7a13f7e57147

SHA256
91b92d7d53f9ffd8be52294182f79d60318455382f3de2a8ea0c569755371245

SHA512
1e143042609409b76f59c30f342041e30c0fb5810d24979734d04e70e248a8d6ec3830c4de5eecb540a353d04355f8bb9ff52de9f83b431d88f7655013255a83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YW15VCHK\4399stat[1].js

Filesize
371B

MD5
ef14cca7e0ddd79592bf28ce43c83f75

SHA1
6d3a788f095fa9e1c37b40345f21bf230e87ec96

SHA256
80e96640292648815c3b392c2b2d5ea3f5a3ae2edcd7740cd3cc802ae02dc264

SHA512
f8ce92fc6932b299256bf71f9146bbaa62774b76cc59d7b1ed2e3be21364ec4a544805b58d6da69a4494913530ddc8e702c1de825ce14de8241fcaa8f19fc123

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab70EE.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\ICD1.tmp\swflash64.inf

Filesize
218B

MD5
60c0b6143a14467a24e31e887954763f

SHA1
77644b4640740ac85fbb201dbc14e5dccdad33ed

SHA256
97ac49c33b06efc45061441a392a55f04548ee47dc48aa8a916de8d13dabec58

SHA512
7032669715c068de67d85d5d00f201ee84bb6edac895559b2a248509024d6ce07c0494835c8ee802dbdbe1bc0b1fb7f4a07417ef864c04ebfaa556663dfd7c7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar71AC.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
\Users\Admin\AppData\Local\Temp\ICD1.tmp\FP_AX_CAB_INSTALLER64.exe

Filesize
757KB

MD5
47f240e7f969bc507334f79b42b3b718

SHA1
8ec5c3294b3854a32636529d73a5f070d5bcf627

SHA256
c8c8cff5dc0a3f205e59f0bbfe30b6ade490c10b9ecc7043f264ec67ef9b6a11

SHA512
10999161970b874db326becd51d5917f17fece7021e27b2c2dfbee42cb4e992c4d5dbeac41093a345ad098c884f6937aa941ec76fb0c9587e9470405ecb67161

Download Submit
memory/2852-0-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download
memory/2852-1768-0x0000000000400000-0x0000000000593000-memory.dmp

Filesize
1.6MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request