rendered paste bodyFile Version : 5.1.2600.2180
File Description : Windows NT Logon Application (winlogon.exe)
File Path : C:\WINDOWS\system32\winlogon.exe
Process ID : 0x36C (Heximal) 876 (Decimal)
Connection origin : local initiated
Protocol : TCP
Local Address : 172.16.35.94
Local Port : 1107
Remote Name :
Remote Address : 211.160.17.195
Remote Port : 80 (HTTP - World Wide Web)
Ethernet packet details:
Ethernet II (Packet Length: 80)
Destination: 00-90-fb-03-05-43
Source: 00-32-1d-6c-3a-4b
Type: IP (0x0800)
Internet Protocol
Version: 4
Header Length: 20 bytes
Flags:
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset:0
Time to live: 128
Protocol: 0x6 (TCP - Transmission Control Protocol)
Header checksum: 0xb33f (Correct)
Source: 172.16.35.94
Destination: 211.160.17.195
Transmission Control Protocol (TCP)
Source port: 1107
Destination port: 80
Sequence number: 3739174665
Acknowledgment number: 0
Header length: 32
Flags:
0... .... = Congestion Window Reduce (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...0 .... = Acknowledgment: Not set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..1. = Syn: Set
.... ...0 = Fin: Not set
Checksum: 0xc18f (Correct)
Data (0 Bytes)
Binary dump of the packet:
0000: 00 90 FB 03 05 43 00 32 : 1D 6C 3A 4B 08 00 45 00 | .....C.2.l:K..E.
0010: 00 34 06 3F 40 00 80 06 : 3F B3 AC 10 23 5E D3 A0 | .4.?@...?...#^..
0020: 11 C3 04 53 00 50 DE DF : 47 09 00 00 00 00 80 02 | ...S.P..G.......
0030: FF FF 8F C1 00 00 02 04 : 05 AC 01 03 03 01 01 01 | ................
0040: 04 02 45 45 50 46 41 44 : 42 44 44 44 44 44 48 43 | ..EEPFADBDDDDDHC