>>> a = "0c0d9d01000074030000789c9d934d4f02410c865fffc91e3ca8c9c27eb02ccb519460221135c60b17022b625408207ec4c493ffdb67ca488c091ecca4dd4ee77d3b6da7bba348bb3a50a2022b564d39df887d032bc79b283544ec757563154802b6b0fdb72f51856f1dbefbba581543d50cb163fa4a973ad68542f5d432cf40233d68a247db5d9b35d254cf5a28208f902c121de25f1a2255c60d29675dbcce53c37e4152eece585d75f4e6b30ab467b936c8638dca2da7fd4de64e3ecfcf3fd6bd884c42eb48685504d69b26ba613af259e478ebec52df956ddcd45819ba860ef48eb893cb0d2bb62a63cfcdecbc3096d319b738e499662ae98debcf184c681d9868a839dd5a20377428a083533ca34d6d6d30f7300378033a5d123300bf82796bcc25ef54d29bd267d7d6138c7bac198c2528c768a1fbbfdea78fbc5a8492c8ee9dfa7f46eee9444716ad60adeb8afc59c73316ccc8854ea9dee16ef12cc9a3c9f455b9d3ad8a55b222ea1c7b08efc166b3a23b90e32df1927fc7fb9ebabaff2b229ba1dcfc6f5437841bdbdf92f85988fcf4fd5ccef305148275f30b"
>>> b = binascii.unhexlify(a)
>>> struct.unpack_from('<HII', b)
(3340, 413, 884)
>>> len(b)
414
>>> c = zlib.decompress(b[10:])
>>> len(c)
884
>>> print(c)
0$*290147002877923$*1$*1/1$*191209$*$*192.168.100.204$*$*USER-PC$*admin$*Windows 7-32Bit$*3583 MB$*4 x 3655MHz$*1 (1280 x 720)$*$*$*?QQ$*2020-01-10 14:18:10$*3746031$*2020-01-10 13:15:45 | 0 S$*2017-10-05 09:19:56$*Opening - Microsoft Word$*$*File name: svchost.exe | Full path: C:\Windows\system32\svchost.exe | PID: 996$*0 | HostsURL1: http://www.naver.com/1.jpg | HostsURL2: http://www.naver.com/1.jpg$*3567920727$*zxcv12321$*0$*1111111$*
Last active
January 11, 2020 19:34
-
-
Save sysopfb/8e783523f07529c4f8e32cf8b5bc2ad2 to your computer and use it in GitHub Desktop.
8713179977a3ac6f2f55d5b566628ea3 notes on traffic
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment